Daniel Deimert
2001-Nov-11 17:21 UTC
winbindd problem with NT4 PDC: samba does not see all the groups
Hi, I would like to report a bug in winbindd that seems to be present in 2.2.2, cvs 2.2.3-pre and cvs HEAD (cvs sources checked out Nov 9). The problem is preventing us from using Samba in production with winbindd. For all three samba versions, winbindd fails with the following symptoms: Samba has successfully joined the NT4 domain (the PDC is running NT) Domain users can access the samba server. wbinfo -g FAILS by only listing 8 groups of 50+ wbinfo -t is OK wbinfo -u is OK wbinfo -s is OK and can lookup groups not listed by wbinfo -g ================================================= Attempting to list all the groups with "wbinfo -g" or "getent group" does not work. $ wbinfo -g FAIRFIELD+Domain Admins FAIRFIELD+Domain Guests FAIRFIELD+Domain Users FAIRFIELD+MIS2 FAIRFIELD+MTS Trusted Impersonators FAIRFIELD+Purchasing FAIRFIELD+RAS FAIRFIELD+SMSInternalCliGrp Note that samba only finds 8 groups. getent group also only displays these 8 groups. There are many more groups available at the PDC. However, if I query wbinfo "in reverse" with wbinfo -G, I can find two more groups, cadread and cadwrite. They can also be mapped from SID to name using wbinfo. Why are they not included in the wbinfo -g (or getent group) listings? $ wbinfo -s S-1-5-21-1563037056-1694922919-879972363-1177 FAIRFIELD+cadread 4 $ wbinfo -s S-1-5-21-1563037056-1694922919-879972363-1176 FAIRFIELD+Cadcreate 4 =================================================Output from from winbindd -d 100 -i ================================================= codepage_initialise: client code page = 850 load_client_codepage: loading codepage 850. Adding chars 0x85 0xb7 (l->u = True) (u->l = True) Adding chars 0xa0 0xb5 (l->u = True) (u->l = True) Adding chars 0x83 0xb6 (l->u = True) (u->l = True) Adding chars 0xc6 0xc7 (l->u = True) (u->l = True) Adding chars 0x84 0x8e (l->u = True) (u->l = True) Adding chars 0x86 0x8f (l->u = True) (u->l = True) Adding chars 0x91 0x92 (l->u = True) (u->l = True) Adding chars 0x87 0x80 (l->u = True) (u->l = True) Adding chars 0x8a 0xd4 (l->u = True) (u->l = True) Adding chars 0x82 0x90 (l->u = True) (u->l = True) Adding chars 0x88 0xd2 (l->u = True) (u->l = True) Adding chars 0x89 0xd3 (l->u = True) (u->l = True) Adding chars 0x8d 0xde (l->u = True) (u->l = True) Adding chars 0xa1 0xd6 (l->u = True) (u->l = True) Adding chars 0x8c 0xd7 (l->u = True) (u->l = True) Adding chars 0x8b 0xd8 (l->u = True) (u->l = True) Adding chars 0xd0 0xd1 (l->u = True) (u->l = True) Adding chars 0xa4 0xa5 (l->u = True) (u->l = True) Adding chars 0x95 0xe3 (l->u = True) (u->l = True) Adding chars 0xa2 0xe0 (l->u = True) (u->l = True) Adding chars 0x93 0xe2 (l->u = True) (u->l = True) Adding chars 0xe4 0xe5 (l->u = True) (u->l = True) Adding chars 0x94 0x99 (l->u = True) (u->l = True) Adding chars 0x9b 0x9d (l->u = True) (u->l = True) Adding chars 0x97 0xeb (l->u = True) (u->l = True) Adding chars 0xa3 0xe9 (l->u = True) (u->l = True) Adding chars 0x96 0xea (l->u = True) (u->l = True) Adding chars 0x81 0x9a (l->u = True) (u->l = True) Adding chars 0xec 0xed (l->u = True) (u->l = True) Adding chars 0xe7 0xe8 (l->u = True) (u->l = True) Adding chars 0x9c 0x0 (l->u = False) (u->l = False) load_unicode_map: loading unicode map for codepage 850. added interface ip=192.168.10.9 bcast=192.168.10.255 nmask=255.255.255.0 establishing connections server: dc=, pwdb_init=0, lsa_hnd=0 resolve_lmhosts: Attempting lmhosts lookup for name FAIRFIELD<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: Attempting wins lookup for name FAIRFIELD<0x1c> wins_srv_count: WINS status: 0 servers. resolve_wins: WINS server resolution selected and no WINS servers listed. name_resolve_bcast: Attempting broadcast lookup for name FAIRFIELD<0x1c> bind succeeded on port 0 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 1 socket option SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 65535 socket option SO_RCVBUF = 65535 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 Sending a packet of len 50 to (192.168.10.255) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 62 parse_nmb: packet id = 16103 Received a packet of len 62 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=16103 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A1C Got a positive name query response from 192.168.10.28 ( 192.168.10.28 ) read_udp_socket: lastip 192.168.10.27 lastport 137 read: 62 parse_nmb: packet id = 16103 Received a packet of len 62 from (192.168.10.27) port 137 nmb packet from 192.168.10.27(137) header: id=16103 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A1B Got a positive name query response from 192.168.10.27 ( 192.168.10.27 ) read_udp_socket: lastip 192.168.10.21 lastport 137 read: 62 parse_nmb: packet id = 16103 Received a packet of len 62 from (192.168.10.21) port 137 nmb packet from 192.168.10.21(137) header: id=16103 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A15 Got a positive name query response from 192.168.10.21 ( 192.168.10.21 ) read_udp_socket: lastip 192.168.10.11 lastport 13485 read: 58 parse_nmb: packet id = 16103 Received a packet of len 58 from (192.168.10.11) port 13485 nmb packet from 192.168.10.11(13485) header: id=16103 opcode=WACK(7) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=10 answers 0 char .. hex 0100 bind succeeded on port 0 Sending a packet of len 50 to (192.168.10.28) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 283 parse_nmb: packet id = 22354 Received a packet of len 283 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=22354 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=*<00> rr_type=33 rr_class=1 ttl=0 answers 0 char .IMT_BDC hex 09494D545F4244432020202020202020 answers 10 char .D.IMT_BDC hex 004400494D545F424443202020202020 answers 20 char D.FAIRFIELD hex 2020204400464149524649454C442020 answers 30 char ...FAIRFIELD hex 2020202000C400464149524649454C44 answers 40 char ...FAIRFIE hex 2020202020201CC40046414952464945 answers 50 char LD ...IMT_B hex 4C442020202020201EC400494D545F42 answers 60 char DC .D.ADM hex 4443202020202020202003440041444D answers 70 char INISTRATOR .D.I hex 494E4953545241544F52202003440049 answers 80 char Net~Services .. hex 4E65747E536572766963657320201CC4 answers 90 char .IS~IMT_BDC..... hex 0049537E494D545F4244430000000000 answers a0 char .D......I....... hex 00440000A0C9ECD64900000000000000 answers b0 char ................ hex 00000000000000000000000000000000 answers c0 char ................ hex 00000000000000000000000000000000 answers d0 char . hex 00 cli_init_creds: user domain flgs: 0 ntlmssp_cli_flgs:0 resolve_srv_name: IMT_BDC resolve_lmhosts: Attempting lmhosts lookup for name IMT_BDC<0x20> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_hosts: Attempting host lookup for name IMT_BDC<0x20> resolve_wins: Attempting wins lookup for name IMT_BDC<0x20> wins_srv_count: WINS status: 0 servers. resolve_wins: WINS server resolution selected and no WINS servers listed. name_resolve_bcast: Attempting broadcast lookup for name IMT_BDC<0x20> bind succeeded on port 0 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 1 socket option SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 65535 socket option SO_RCVBUF = 65535 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 Sending a packet of len 50 to (192.168.10.255) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 62 parse_nmb: packet id = 21084 Received a packet of len 62 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=21084 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=IMT_BDC<20> rr_type=32 rr_class=1 ttl=300000 answers 0 char `..... hex 6000C0A80A1C Got a positive name query response from 192.168.10.28 ( 192.168.10.28 ) read_udp_socket: lastip 192.168.10.11 lastport 13488 read: 58 parse_nmb: packet id = 21084 Received a packet of len 58 from (192.168.10.11) port 13488 nmb packet from 192.168.10.11(13488) header: id=21084 opcode=WACK(7) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=IMT_BDC<20> rr_type=32 rr_class=1 ttl=10 answers 0 char .. hex 0100 cli_establish_connection: CADFILES<00> connecting to IMT_BDC<20> (192.168.10.28) - [] Connecting to 192.168.10.28 at port 139 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 0 socket option SO_BROADCAST = 0 socket option TCP_NODELAY = 1 socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 16384 socket option SO_RCVBUF = 16384 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 write_socket(7,76) write_socket(7,76) wrote 76 Sent session request got smb length of 0 size=0 smb_com=0x0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=0 smb_flg2=0 smb_tid=0 smb_pid=0 smb_uid=0 smb_mid=0 smt_wct=0 smb_bcc=0 write_socket(7,168) write_socket(7,168) wrote 168 got smb length of 97 size=97 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=1 smb_tid=0 smb_pid=17005 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[0]=7 (0x7) smb_vwv[1]=12803 (0x3203) smb_vwv[2]=256 (0x100) smb_vwv[3]=1024 (0x400) smb_vwv[4]=17 (0x11) smb_vwv[5]=0 (0x0) smb_vwv[6]=256 (0x100) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=64768 (0xFD00) smb_vwv[10]=67 (0x43) smb_vwv[11]=20480 (0x5000) smb_vwv[12]=25538 (0x63C2) smb_vwv[13]=30973 (0x78FD) smb_vwv[14]=49513 (0xC169) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]=2049 (0x801) smb_bcc=28 [000] 2C 79 A6 1F D6 99 D6 2E 46 00 41 00 49 00 52 00 ,y...... F.A.I.R. [010] 46 00 49 00 45 00 4C 00 44 00 00 00 F.I.E.L. D... size=97 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=1 smb_tid=0 smb_pid=17005 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[0]=7 (0x7) smb_vwv[1]=12803 (0x3203) smb_vwv[2]=256 (0x100) smb_vwv[3]=1024 (0x400) smb_vwv[4]=17 (0x11) smb_vwv[5]=0 (0x0) smb_vwv[6]=256 (0x100) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=64768 (0xFD00) smb_vwv[10]=67 (0x43) smb_vwv[11]=20480 (0x5000) smb_vwv[12]=25538 (0x63C2) smb_vwv[13]=30973 (0x78FD) smb_vwv[14]=49513 (0xC169) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]=2049 (0x801) smb_bcc=28 [000] 2C 79 A6 1F D6 99 D6 2E 46 00 41 00 49 00 52 00 ,y...... F.A.I.R. [010] 46 00 49 00 45 00 4C 00 44 00 00 00 F.I.E.L. D... write_socket(7,92) write_socket(7,92) wrote 92 got smb length of 130 size=130 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=0 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=130 (0x82) smb_vwv[2]=0 (0x0) smb_bcc=89 [000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N [020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a [030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4.. [040] 00 30 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .0...F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 00 .E.L.D.. . size=130 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=0 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=130 (0x82) smb_vwv[2]=0 (0x0) smb_bcc=89 [000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N [020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a [030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4.. [040] 00 30 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .0...F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 00 .E.L.D.. . write_socket(7,82) write_socket(7,82) wrote 82 got smb length of 48 size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=48 (0x30) smb_vwv[2]=1 (0x1) smb_bcc=7 [000] 49 50 43 00 00 00 00 IPC.... write_socket(7,104) write_socket(7,104) wrote 104 got smb length of 103 size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=34 smb_vwv[0]=255 (0xFF) smb_vwv[1]=103 (0x67) smb_vwv[2]=5632 (0x1600) smb_vwv[3]=264 (0x108) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_vwv[12]=0 (0x0) smb_vwv[13]=0 (0x0) smb_vwv[14]=0 (0x0) smb_vwv[15]=0 (0x0) smb_vwv[16]=0 (0x0) smb_vwv[17]=0 (0x0) smb_vwv[18]=0 (0x0) smb_vwv[19]=0 (0x0) smb_vwv[20]=0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]=0 (0x0) smb_vwv[23]=0 (0x0) smb_vwv[24]=16 (0x10) smb_vwv[25]=0 (0x0) smb_vwv[26]=0 (0x0) smb_vwv[27]=0 (0x0) smb_vwv[28]=0 (0x0) smb_vwv[29]=0 (0x0) smb_vwv[30]=0 (0x0) smb_vwv[31]=512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]=5 (0x5) smb_bcc=0 Bind RPC Pipe[816]: \PIPE\lsarpc Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. [010] 00 00 00 00 .... Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 00 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000001 000010 smb_io_rpc_hdr_rb 000010 smb_io_rpc_hdr_bba 0010 max_tsize: 1630 0012 max_rsize: 1630 0014 assoc_gid: 00000000 0018 num_elements: 00000001 001c context_id : 0000 001e num_syntaxes: 01 00001f smb_io_rpc_iface 0020 data : 12345778 0024 data : 1234 0026 data : abcd 0028 data : ef 00 01 23 45 67 89 ab 0030 version: 00000000 000034 smb_io_rpc_iface 0034 data : 8a885d04 0038 data : 1ceb 003a data : 11c9 003c data : 9f e8 08 00 2b 10 48 60 0044 version: 00000002 rpc_api_pipe: cmd:26 fnum:816 size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=72 (0x48) smb_vwv[2]=0 (0x0) smb_vwv[3]=72 (0x48) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=72 (0x48) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=87 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 00 10 00 00 00 48 00 00 00 01 00 00 00 30 .......H .......0 [020] 16 30 16 00 00 00 00 01 00 00 00 00 00 01 00 78 .0...... .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... write_socket(7,158) write_socket(7,158) wrote 158 got smb length of 124 size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=68 (0x44) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=68 (0x44) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=69 [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D...... [010] 00 30 16 30 16 CA 9D 00 00 0C 00 5C 50 49 50 45 .0.0.... ...\PIPE [020] 5C 6C 73 61 73 73 00 14 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=68 (0x44) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=68 (0x44) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=69 [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D...... [010] 00 30 16 30 16 CA 9D 00 00 0C 00 5C 50 49 50 45 .0.0.... ...\PIPE [020] 5C 6C 73 61 73 73 00 14 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... rpc_check_hdr: rdata->data_size = 68 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000001 rpc_api_pipe: len left: 0 smbtrans read: 68 rpc_api_pipe: fragment first and last both set rpc_pipe_bind: rpc_api_pipe returned OK. 000010 smb_io_rpc_hdr_ba 000010 smb_io_rpc_hdr_bba 0010 max_tsize: 1630 0012 max_rsize: 1630 0014 assoc_gid: 00009dca 000018 smb_io_rpc_addr_str 0018 len: 000c 001a str: \PIPE\lsass. 000026 smb_io_rpc_results 0028 num_results: 01 002c result : 0000 002e reason : 0000 000030 smb_io_rpc_iface 0030 data : 8a885d04 0034 data : 1ceb 0036 data : 11c9 0038 data : 9f e8 08 00 2b 10 48 60 0040 version: 00000002 bind_rpc_pipe: server pipe_name found: \PIPE\lsass bind_rpc_pipe: accepted! init_open_pol: attr:0 da:33554432 init_lsa_obj_attr 000000 lsa_io_q_open_pol 0000 ptr : 00000001 0004 system_name: 005c 000008 lsa_io_obj_attr 0008 len : 00000018 000c ptr_root_dir: 00000000 0010 ptr_obj_name: 00000000 0014 attributes : 00000000 0018 ptr_sec_desc: 00000000 001c ptr_sec_qos : 00000000 0020 des_access: 02000000 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0x6 data_len: 0x3c create_rpc_request: data_len: 3c auth_len: 0 alloc_hint: 2c 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 003c 000a auth_len : 0000 000c call_id : 00000002 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000002c 0014 context_id: 0000 0016 opnum : 0006 data_len: 3c data_calc_len: 3c rpc_api_pipe: cmd:26 fnum:816 size=142 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=60 (0x3C) smb_vwv[2]=0 (0x0) smb_vwv[3]=60 (0x3C) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=60 (0x3C) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=75 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 3C 00 00 00 02 00 00 00 2C .......< ......., [020] 00 00 00 00 00 06 00 01 00 00 00 5C 00 00 00 18 ........ ...\.... [030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ [040] 00 00 00 00 00 00 00 00 00 00 02 ........ ... write_socket(7,146) write_socket(7,146) wrote 146 got smb length of 104 size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 3C 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 <....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 42 88 78 ........ .....B.x [020] FE 56 E6 2C 4F A3 DB B6 20 4E FC E2 08 00 00 00 .V.,O... N...... [030] 00 . size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 3C 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 <....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 42 88 78 ........ .....B.x [020] FE 56 E6 2C 4F A3 DB B6 20 4E FC E2 08 00 00 00 .V.,O... N...... [030] 00 . rpc_check_hdr: rdata->data_size = 48 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000002 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 0 smbtrans read: 48 rpc_api_pipe: fragment first and last both set 000018 lsa_io_r_open_pol 000018 smb_io_pol_hnd 0018 data1: 00000000 001c data2: fe788842 0020 data3: e656 0022 data4: 4f2c 0024 data5: a3 db b6 20 4e fc e2 08 002c status: 00000000 getting trusted domain list adding trusted domain FAIRFIELD init_q_enum_trust_dom 000000 lsa_io_q_enum_trust_dom 000000 smb_io_pol_hnd 0000 data1: 00000000 0004 data2: fe788842 0008 data3: e656 000a data4: 4f2c 000c data5: a3 db b6 20 4e fc e2 08 0014 enum_context : 00000000 0018 preferred_len: ffffffff rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0xd data_len: 0x34 create_rpc_request: data_len: 34 auth_len: 0 alloc_hint: 24 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0034 000a auth_len : 0000 000c call_id : 00000003 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 00000024 0014 context_id: 0000 0016 opnum : 000d data_len: 34 data_calc_len: 34 rpc_api_pipe: cmd:26 fnum:816 size=134 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=52 (0x34) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=52 (0x34) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=67 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 34 00 00 00 03 00 00 00 24 .......4 .......$ [020] 00 00 00 00 00 0D 00 00 00 00 00 42 88 78 FE 56 ........ ...B.x.V [030] E6 2C 4F A3 DB B6 20 4E FC E2 08 00 00 00 00 FF .,O... N ........ [040] FF FF FF ... write_socket(7,138) write_socket(7,138) wrote 138 got smb length of 108 size=108 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=52 (0x34) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=53 [000] 34 05 00 02 03 10 00 00 00 70 00 00 00 03 00 00 4....... .p...... [010] 00 58 00 00 00 00 00 00 00 01 00 00 00 01 00 00 .X...... ........ [020] 00 F0 CF 42 0F 01 00 00 00 10 00 10 00 B8 AB 45 ...B.... .......E [030] 0F C8 F5 19 00 ..... size=108 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=52 (0x34) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=53 [000] 34 05 00 02 03 10 00 00 00 70 00 00 00 03 00 00 4....... .p...... [010] 00 58 00 00 00 00 00 00 00 01 00 00 00 01 00 00 .X...... ........ [020] 00 F0 CF 42 0F 01 00 00 00 10 00 10 00 B8 AB 45 ...B.... .......E [030] 0F C8 F5 19 00 ..... rpc_check_hdr: rdata->data_size = 52 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0070 000a auth_len : 0000 000c call_id : 00000003 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 00000058 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 60 smbtrans read: 52 rpc_read: data_to_read: 60 rdata offset: 52 extra_data_size: 60 rpc_read: grew buffer by 60 bytes to 112 write_socket(7,59) write_socket(7,59) wrote 59 got smb length of 120 size=120 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=12 smb_vwv[0]=255 (0xFF) smb_vwv[1]=0 (0x0) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=0 (0x0) smb_vwv[5]=60 (0x3C) smb_vwv[6]=60 (0x3C) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_bcc=61 [000] 03 08 00 00 00 00 00 00 00 08 00 00 00 49 00 4E ........ .....I.N [010] 00 54 00 45 00 52 00 4D 00 45 00 43 00 04 00 00 .T.E.R.M .E.C.... [020] 00 01 04 00 00 00 00 00 05 15 00 00 00 1D 66 1A ........ ......f. [030] 05 F8 19 A0 50 AB 15 05 2D 00 00 00 00 ....P... -.... rpc_read: num_read = 60, read offset: 0, to read: 60 rpc_api_pipe: fragment first and last both set 000018 lsa_io_r_enum_trust_dom 0018 enum_context : 00000001 001c num_domains : 00000001 0020 ptr_enum_domains: 0f42cff0 0024 num_domains2: 00000001 000028 smb_io_unihdr2 000028 smb_io_unihdr hdr 0028 uni_str_len: 0010 002a uni_max_len: 0010 002c buffer : 0f45abb8 0030 buffer: 0019f5c8 000034 smb_io_unistr2 0034 uni_max_len: 00000008 0038 undoc : 00000000 003c uni_str_len: 00000008 0040 buffer : I.N.T.E.R.M.E.C. 000050 smb_io_dom_sid2 0050 num_auths: 00000004 000054 smb_io_dom_sid sid 0054 sid_rev_num: 01 0055 num_auths : 04 0056 id_auth[0] : 00 0057 id_auth[1] : 00 0058 id_auth[2] : 00 0059 id_auth[3] : 00 005a id_auth[4] : 00 005b id_auth[5] : 05 005c sub_auths : 00000015 051a661d 50a019f8 2d0515ab 006c status: 00000000 adding trusted domain INTERMEC server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 accepted socket 10 [17006]: list groups checking domain handles for domain INTERMEC server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 opening sam handles Getting domain info for domain INTERMEC looking up sid for domain INTERMEC resolve_lmhosts: Attempting lmhosts lookup for name INTERMEC<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: Attempting wins lookup for name INTERMEC<0x1c> wins_srv_count: WINS status: 0 servers. resolve_wins: WINS server resolution selected and no WINS servers listed. name_resolve_bcast: Attempting broadcast lookup for name INTERMEC<0x1c> bind succeeded on port 0 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 1 socket option SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 65535 socket option SO_RCVBUF = 65535 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 Sending a packet of len 50 to (192.168.10.255) on port 137 read_udp_socket: lastip 192.168.10.12 lastport 137 read: 62 parse_nmb: packet id = 3242 Received a packet of len 62 from (192.168.10.12) port 137 nmb packet from 192.168.10.12(137) header: id=3242 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=INTERMEC<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A0C Got a positive name query response from 192.168.10.12 ( 192.168.10.12 ) read_udp_socket: lastip 192.168.10.11 lastport 13501 read: 58 parse_nmb: packet id = 3242 Received a packet of len 58 from (192.168.10.11) port 13501 nmb packet from 192.168.10.11(13501) header: id=3242 opcode=WACK(7) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=INTERMEC<1c> rr_type=32 rr_class=1 ttl=10 answers 0 char .. hex 0100 bind succeeded on port 0 Sending a packet of len 50 to (192.168.10.12) on port 137 read_udp_socket: lastip 192.168.10.11 lastport 13508 read: 56 parse_nmb: packet id = 3242 Received a packet of len 56 from (192.168.10.11) port 13508 Sending a packet of len 50 to (192.168.10.12) on port 137 Could not resolve domain controller for domain INTERMEC could not find sid for domain INTERMEC checking domain handles for domain FAIRFIELD server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 opening sam handles Getting domain info for domain FAIRFIELD looking up sid for domain FAIRFIELD resolve_lmhosts: Attempting lmhosts lookup for name FAIRFIELD<0x1c> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_wins: Attempting wins lookup for name FAIRFIELD<0x1c> wins_srv_count: WINS status: 0 servers. resolve_wins: WINS server resolution selected and no WINS servers listed. name_resolve_bcast: Attempting broadcast lookup for name FAIRFIELD<0x1c> bind succeeded on port 0 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 1 socket option SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 65535 socket option SO_RCVBUF = 65535 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 Sending a packet of len 50 to (192.168.10.255) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 62 parse_nmb: packet id = 8567 Received a packet of len 62 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=8567 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A1C Got a positive name query response from 192.168.10.28 ( 192.168.10.28 ) read_udp_socket: lastip 192.168.10.27 lastport 137 read: 62 parse_nmb: packet id = 8567 Received a packet of len 62 from (192.168.10.27) port 137 nmb packet from 192.168.10.27(137) header: id=8567 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A1B Got a positive name query response from 192.168.10.27 ( 192.168.10.27 ) read_udp_socket: lastip 192.168.10.21 lastport 137 read: 62 parse_nmb: packet id = 8567 Received a packet of len 62 from (192.168.10.21) port 137 nmb packet from 192.168.10.21(137) header: id=8567 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=300000 answers 0 char ...... hex E000C0A80A15 Got a positive name query response from 192.168.10.21 ( 192.168.10.21 ) read_udp_socket: lastip 192.168.10.11 lastport 13509 read: 58 parse_nmb: packet id = 8567 Received a packet of len 58 from (192.168.10.11) port 13509 nmb packet from 192.168.10.11(13509) header: id=8567 opcode=WACK(7) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=FAIRFIELD<1c> rr_type=32 rr_class=1 ttl=10 answers 0 char .. hex 0100 bind succeeded on port 0 Sending a packet of len 50 to (192.168.10.28) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 283 parse_nmb: packet id = 10272 Received a packet of len 283 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=10272 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=*<00> rr_type=33 rr_class=1 ttl=0 answers 0 char .IMT_BDC hex 09494D545F4244432020202020202020 answers 10 char .D.IMT_BDC hex 004400494D545F424443202020202020 answers 20 char D.FAIRFIELD hex 2020204400464149524649454C442020 answers 30 char ...FAIRFIELD hex 2020202000C400464149524649454C44 answers 40 char ...FAIRFIE hex 2020202020201CC40046414952464945 answers 50 char LD ...IMT_B hex 4C442020202020201EC400494D545F42 answers 60 char DC .D.ADM hex 4443202020202020202003440041444D answers 70 char INISTRATOR .D.I hex 494E4953545241544F52202003440049 answers 80 char Net~Services .. hex 4E65747E536572766963657320201CC4 answers 90 char .IS~IMT_BDC..... hex 0049537E494D545F4244430000000000 answers a0 char .D......I....... hex 00440000A0C9ECD64900000000000000 answers b0 char ................ hex 00000000000000000000000000000000 answers c0 char ................ hex 00000000000000000000000000000000 answers d0 char . hex 00 init_q_query 000000 lsa_io_q_query 000000 smb_io_pol_hnd 0000 data1: 00000000 0004 data2: fe788842 0008 data3: e656 000a data4: 4f2c 000c data5: a3 db b6 20 4e fc e2 08 0014 info_class: 0005 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0x7 data_len: 0x2e create_rpc_request: data_len: 2e auth_len: 0 alloc_hint: 1e 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 002e 000a auth_len : 0000 000c call_id : 00000004 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000001e 0014 context_id: 0000 0016 opnum : 0007 data_len: 2e data_calc_len: 2e rpc_api_pipe: cmd:26 fnum:816 size=128 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=46 (0x2E) smb_vwv[2]=0 (0x0) smb_vwv[3]=46 (0x2E) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=46 (0x2E) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=61 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 2E 00 00 00 04 00 00 00 1E ........ ........ [020] 00 00 00 00 00 07 00 00 00 00 00 42 88 78 FE 56 ........ ...B.x.V [030] E6 2C 4F A3 DB B6 20 4E FC E2 08 05 00 .,O... N ..... write_socket(7,132) write_socket(7,132) wrote 132 got smb length of 102 size=102 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=46 (0x2E) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=46 (0x2E) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=47 [000] 2E 05 00 02 03 10 00 00 00 6C 00 00 00 04 00 00 ........ .l...... [010] 00 54 00 00 00 00 00 00 00 20 CA 15 00 05 00 00 .T...... . ...... [020] 00 12 00 14 00 C8 F5 19 00 10 45 1D 00 0A 00 ........ ..E.... size=102 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=46 (0x2E) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=46 (0x2E) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=47 [000] 2E 05 00 02 03 10 00 00 00 6C 00 00 00 04 00 00 ........ .l...... [010] 00 54 00 00 00 00 00 00 00 20 CA 15 00 05 00 00 .T...... . ...... [020] 00 12 00 14 00 C8 F5 19 00 10 45 1D 00 0A 00 ........ ..E.... rpc_check_hdr: rdata->data_size = 46 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 006c 000a auth_len : 0000 000c call_id : 00000004 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 00000054 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 62 smbtrans read: 46 rpc_read: data_to_read: 62 rdata offset: 46 extra_data_size: 62 rpc_read: grew buffer by 62 bytes to 108 write_socket(7,59) write_socket(7,59) wrote 59 got smb length of 122 size=122 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=12 smb_vwv[0]=255 (0xFF) smb_vwv[1]=0 (0x0) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=0 (0x0) smb_vwv[5]=62 (0x3E) smb_vwv[6]=60 (0x3C) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_bcc=63 [000] 03 00 00 00 00 00 00 09 00 00 00 46 00 41 00 49 ........ ...F.A.I [010] 00 52 00 46 00 49 00 45 00 4C 00 44 00 4D 00 04 .R.F.I.E .L.D.M.. [020] 00 00 00 01 04 00 00 00 00 00 05 15 00 00 00 80 ........ ........ [030] 0D 2A 5D A7 78 06 65 0B 50 73 34 00 00 00 00 .*].x.e. Ps4.... rpc_read: num_read = 62, read offset: 0, to read: 62 rpc_api_pipe: fragment first and last both set 000018 lsa_io_r_query 0018 undoc_buffer: 0015ca20 001c info_class: 0005 000020 lsa_io_dom_query 0020 uni_dom_max_len: 0012 0022 uni_dom_str_len: 0014 0024 buffer_dom_name: 0019f5c8 0028 buffer_dom_sid : 001d4510 00002c smb_io_unistr2 unistr2 002c uni_max_len: 0000000a 0030 undoc : 00000000 0034 uni_str_len: 00000009 0038 buffer : F.A.I.R.F.I.E.L.D. 00004c smb_io_dom_sid2 004c num_auths: 00000004 000050 smb_io_dom_sid sid 0050 sid_rev_num: 01 0051 num_auths : 04 0052 id_auth[0] : 00 0053 id_auth[1] : 00 0054 id_auth[2] : 00 0055 id_auth[3] : 00 0056 id_auth[4] : 00 0057 id_auth[5] : 05 0058 sub_auths : 00000015 5d2a0d80 650678a7 3473500b 0068 status: 00000000 found sid S-1-5-21-1563037056-1694922919-879972363 for domain FAIRFIELD cli_init_creds: user domain flgs: 0 ntlmssp_cli_flgs:0 resolve_srv_name: IMT_BDC resolve_lmhosts: Attempting lmhosts lookup for name IMT_BDC<0x20> getlmhostsent: lmhost entry: 127.0.0.1 localhost resolve_hosts: Attempting host lookup for name IMT_BDC<0x20> resolve_wins: Attempting wins lookup for name IMT_BDC<0x20> wins_srv_count: WINS status: 0 servers. resolve_wins: WINS server resolution selected and no WINS servers listed. name_resolve_bcast: Attempting broadcast lookup for name IMT_BDC<0x20> bind succeeded on port 0 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 1 socket option SO_BROADCAST = 1 Could not test socket option TCP_NODELAY. socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 65535 socket option SO_RCVBUF = 65535 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 Sending a packet of len 50 to (192.168.10.255) on port 137 read_udp_socket: lastip 192.168.10.28 lastport 137 read: 62 parse_nmb: packet id = 16379 Received a packet of len 62 from (192.168.10.28) port 137 nmb packet from 192.168.10.28(137) header: id=16379 opcode=Query(0) response=Yes header: flags: bcast=No rec_avail=No rec_des=Yes trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=IMT_BDC<20> rr_type=32 rr_class=1 ttl=300000 answers 0 char `..... hex 6000C0A80A1C Got a positive name query response from 192.168.10.28 ( 192.168.10.28 ) read_udp_socket: lastip 192.168.10.11 lastport 13512 read: 58 parse_nmb: packet id = 16379 Received a packet of len 58 from (192.168.10.11) port 13512 nmb packet from 192.168.10.11(13512) header: id=16379 opcode=WACK(7) response=Yes header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 answers: nmb_name=IMT_BDC<20> rr_type=32 rr_class=1 ttl=10 answers 0 char .. hex 0100 cli_establish_connection: CADFILES<00> connecting to IMT_BDC<20> (192.168.10.28) - [] Connecting to 192.168.10.28 at port 139 socket option SO_KEEPALIVE = 0 socket option SO_REUSEADDR = 0 socket option SO_BROADCAST = 0 socket option TCP_NODELAY = 1 socket option IPTOS_LOWDELAY = 0 socket option IPTOS_THROUGHPUT = 0 socket option SO_SNDBUF = 16384 socket option SO_RCVBUF = 16384 socket option SO_SNDLOWAT = 1 socket option SO_RCVLOWAT = 1 socket option SO_SNDTIMEO = 0 socket option SO_RCVTIMEO = 0 write_socket(11,76) write_socket(11,76) wrote 76 Sent session request got smb length of 0 size=0 smb_com=0x0 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=0 smb_flg2=0 smb_tid=0 smb_pid=0 smb_uid=0 smb_mid=0 smt_wct=0 smb_bcc=0 write_socket(11,168) write_socket(11,168) wrote 168 got smb length of 97 size=97 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=1 smb_tid=0 smb_pid=17005 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[0]=7 (0x7) smb_vwv[1]=12803 (0x3203) smb_vwv[2]=256 (0x100) smb_vwv[3]=1024 (0x400) smb_vwv[4]=17 (0x11) smb_vwv[5]=0 (0x0) smb_vwv[6]=256 (0x100) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=64768 (0xFD00) smb_vwv[10]=67 (0x43) smb_vwv[11]=15872 (0x3E00) smb_vwv[12]=13717 (0x3595) smb_vwv[13]=30982 (0x7906) smb_vwv[14]=49513 (0xC169) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]=2049 (0x801) smb_bcc=28 [000] 0B 2D E3 79 20 8E 2C 10 46 00 41 00 49 00 52 00 .-.y .,. F.A.I.R. [010] 46 00 49 00 45 00 4C 00 44 00 00 00 F.I.E.L. D... size=97 smb_com=0x72 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=1 smb_tid=0 smb_pid=17005 smb_uid=0 smb_mid=1 smt_wct=17 smb_vwv[0]=7 (0x7) smb_vwv[1]=12803 (0x3203) smb_vwv[2]=256 (0x100) smb_vwv[3]=1024 (0x400) smb_vwv[4]=17 (0x11) smb_vwv[5]=0 (0x0) smb_vwv[6]=256 (0x100) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=64768 (0xFD00) smb_vwv[10]=67 (0x43) smb_vwv[11]=15872 (0x3E00) smb_vwv[12]=13717 (0x3595) smb_vwv[13]=30982 (0x7906) smb_vwv[14]=49513 (0xC169) smb_vwv[15]=11265 (0x2C01) smb_vwv[16]=2049 (0x801) smb_bcc=28 [000] 0B 2D E3 79 20 8E 2C 10 46 00 41 00 49 00 52 00 .-.y .,. F.A.I.R. [010] 46 00 49 00 45 00 4C 00 44 00 00 00 F.I.E.L. D... write_socket(11,92) write_socket(11,92) wrote 92 got smb length of 130 size=130 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=0 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=130 (0x82) smb_vwv[2]=0 (0x0) smb_bcc=89 [000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N [020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a [030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4.. [040] 00 30 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .0...F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 00 .E.L.D.. . size=130 smb_com=0x73 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=0 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=130 (0x82) smb_vwv[2]=0 (0x0) smb_bcc=89 [000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s. [010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N [020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a [030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4.. [040] 00 30 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .0...F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 00 .E.L.D.. . write_socket(11,82) write_socket(11,82) wrote 82 got smb length of 48 size=48 smb_com=0x75 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=3 smb_vwv[0]=255 (0xFF) smb_vwv[1]=48 (0x30) smb_vwv[2]=1 (0x1) smb_bcc=7 [000] 49 50 43 00 00 00 00 IPC.... write_socket(11,100) write_socket(11,100) wrote 100 got smb length of 103 size=103 smb_com=0xa2 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=34 smb_vwv[0]=255 (0xFF) smb_vwv[1]=103 (0x67) smb_vwv[2]=2560 (0xA00) smb_vwv[3]=264 (0x108) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_vwv[12]=0 (0x0) smb_vwv[13]=0 (0x0) smb_vwv[14]=0 (0x0) smb_vwv[15]=0 (0x0) smb_vwv[16]=0 (0x0) smb_vwv[17]=0 (0x0) smb_vwv[18]=0 (0x0) smb_vwv[19]=0 (0x0) smb_vwv[20]=0 (0x0) smb_vwv[21]=32768 (0x8000) smb_vwv[22]=0 (0x0) smb_vwv[23]=0 (0x0) smb_vwv[24]=16 (0x10) smb_vwv[25]=0 (0x0) smb_vwv[26]=0 (0x0) smb_vwv[27]=0 (0x0) smb_vwv[28]=0 (0x0) smb_vwv[29]=0 (0x0) smb_vwv[30]=0 (0x0) smb_vwv[31]=512 (0x200) smb_vwv[32]=65280 (0xFF00) smb_vwv[33]=5 (0x5) smb_bcc=0 Bind RPC Pipe[80a]: \PIPE\samr Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AC xW4.4... ...#Eg.. [010] 01 00 00 00 .... Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` [010] 02 00 00 00 .... 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0b 0003 flags : 00 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0048 000a auth_len : 0000 000c call_id : 00000005 000010 smb_io_rpc_hdr_rb 000010 smb_io_rpc_hdr_bba 0010 max_tsize: 1630 0012 max_rsize: 1630 0014 assoc_gid: 00000000 0018 num_elements: 00000001 001c context_id : 0000 001e num_syntaxes: 01 00001f smb_io_rpc_iface 0020 data : 12345778 0024 data : 1234 0026 data : abcd 0028 data : ef 00 01 23 45 67 89 ac 0030 version: 00000001 000034 smb_io_rpc_iface 0034 data : 8a885d04 0038 data : 1ceb 003a data : 11c9 003c data : 9f e8 08 00 2b 10 48 60 0044 version: 00000002 rpc_api_pipe: cmd:26 fnum:80a size=154 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=72 (0x48) smb_vwv[2]=0 (0x0) smb_vwv[3]=72 (0x48) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=72 (0x48) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2058 (0x80A) smb_bcc=87 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 0B 00 10 00 00 00 48 00 00 00 05 00 00 00 30 .......H .......0 [020] 16 30 16 00 00 00 00 01 00 00 00 00 00 01 00 78 .0...... .......x [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 W4.4.... ..#Eg... [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ [050] 10 48 60 02 00 00 00 .H`.... write_socket(11,158) write_socket(11,158) wrote 158 got smb length of 124 size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=68 (0x44) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=68 (0x44) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=69 [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 05 00 00 H....... .D...... [010] 00 30 16 30 16 CE 9D 00 00 0C 00 5C 50 49 50 45 .0.0.... ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... size=124 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=68 (0x44) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=68 (0x44) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=69 [000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 05 00 00 H....... .D...... [010] 00 30 16 30 16 CE 9D 00 00 0C 00 5C 50 49 50 45 .0.0.... ...\PIPE [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H [040] 60 02 00 00 00 `.... rpc_check_hdr: rdata->data_size = 68 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 0c 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0044 000a auth_len : 0000 000c call_id : 00000005 rpc_api_pipe: len left: 0 smbtrans read: 68 rpc_api_pipe: fragment first and last both set rpc_pipe_bind: rpc_api_pipe returned OK. 000010 smb_io_rpc_hdr_ba 000010 smb_io_rpc_hdr_bba 0010 max_tsize: 1630 0012 max_rsize: 1630 0014 assoc_gid: 00009dce 000018 smb_io_rpc_addr_str 0018 len: 000c 001a str: \PIPE\lsass. 000026 smb_io_rpc_results 0028 num_results: 01 002c result : 0000 002e reason : 0000 000030 smb_io_rpc_iface 0030 data : 8a885d04 0034 data : 1ceb 0036 data : 11c9 0038 data : 9f e8 08 00 2b 10 48 60 0040 version: 00000002 bind_rpc_pipe: server pipe_name found: \PIPE\lsass bind_rpc_pipe: accepted! init_samr_q_connect 000000 samr_io_q_connect 0000 ptr_srv_name: 00000001 000004 smb_io_unistr2 0004 uni_max_len: 00000008 0008 undoc : 00000000 000c uni_str_len: 00000008 0010 buffer : I.M.T._.B.D.C... 0020 access_mask: 02000000 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0x39 data_len: 0x3c create_rpc_request: data_len: 3c auth_len: 0 alloc_hint: 2c 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 003c 000a auth_len : 0000 000c call_id : 00000006 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000002c 0014 context_id: 0000 0016 opnum : 0039 data_len: 3c data_calc_len: 3c rpc_api_pipe: cmd:26 fnum:80a size=142 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=60 (0x3C) smb_vwv[2]=0 (0x0) smb_vwv[3]=60 (0x3C) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=60 (0x3C) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2058 (0x80A) smb_bcc=75 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 3C 00 00 00 06 00 00 00 2C .......< ......., [020] 00 00 00 00 00 39 00 01 00 00 00 08 00 00 00 00 .....9.. ........ [030] 00 00 00 08 00 00 00 49 00 4D 00 54 00 5F 00 42 .......I .M.T._.B [040] 00 44 00 43 00 00 00 00 00 00 02 .D.C.... ... write_socket(11,146) write_socket(11,146) wrote 146 got smb length of 104 size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 3C 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 <....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 21 9B B9 ........ .....!.. [020] D1 2E 43 CD 4D B2 22 94 E4 4F B2 71 C6 00 00 00 ..C.M.". .O.q.... [030] 00 . size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 3C 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 <....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 21 9B B9 ........ .....!.. [020] D1 2E 43 CD 4D B2 22 94 E4 4F B2 71 C6 00 00 00 ..C.M.". .O.q.... [030] 00 . rpc_check_hdr: rdata->data_size = 48 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000006 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 0 smbtrans read: 48 rpc_api_pipe: fragment first and last both set 000018 samr_io_r_connect 000018 smb_io_pol_hnd connect_pol 0018 data1: 00000000 001c data2: d1b99b21 0020 data3: 432e 0022 data4: 4dcd 0024 data5: b2 22 94 e4 4f b2 71 c6 002c status: 00000000 samr_init_samr_q_open_domain 000000 samr_io_q_open_domain 000000 smb_io_pol_hnd pol 0000 data1: 00000000 0004 data2: d1b99b21 0008 data3: 432e 000a data4: 4dcd 000c data5: b2 22 94 e4 4f b2 71 c6 0014 flags: 02000000 000018 smb_io_dom_sid2 sid 0018 num_auths: 00000004 00001c smb_io_dom_sid sid 001c sid_rev_num: 01 001d num_auths : 04 001e id_auth[0] : 00 001f id_auth[1] : 00 0020 id_auth[2] : 00 0021 id_auth[3] : 00 0022 id_auth[4] : 00 0023 id_auth[5] : 05 0024 sub_auths : 00000015 5d2a0d80 650678a7 3473500b rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0x7 data_len: 0x4c create_rpc_request: data_len: 4c auth_len: 0 alloc_hint: 3c 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 004c 000a auth_len : 0000 000c call_id : 00000007 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000003c 0014 context_id: 0000 0016 opnum : 0007 data_len: 4c data_calc_len: 4c rpc_api_pipe: cmd:26 fnum:80a size=158 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=76 (0x4C) smb_vwv[2]=0 (0x0) smb_vwv[3]=76 (0x4C) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=76 (0x4C) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2058 (0x80A) smb_bcc=91 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 4C 00 00 00 07 00 00 00 3C .......L .......< [020] 00 00 00 00 00 07 00 00 00 00 00 21 9B B9 D1 2E ........ ...!.... [030] 43 CD 4D B2 22 94 E4 4F B2 71 C6 00 00 00 02 04 C.M."..O .q...... [040] 00 00 00 01 04 00 00 00 00 00 05 15 00 00 00 80 ........ ........ [050] 0D 2A 5D A7 78 06 65 0B 50 73 34 .*].x.e. Ps4 write_socket(11,162) write_socket(11,162) wrote 162 got smb length of 104 size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 4C 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 L....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 13 BC 15 ........ ........ [020] 22 4E 3D F4 4C 9F 0F 69 B7 26 98 D3 0F 00 00 00 "N=.L..i .&...... [030] 00 . size=104 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=48 (0x30) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=48 (0x30) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=49 [000] 4C 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 L....... .0...... [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 13 BC 15 ........ ........ [020] 22 4E 3D F4 4C 9F 0F 69 B7 26 98 D3 0F 00 00 00 "N=.L..i .&...... [030] 00 . rpc_check_hdr: rdata->data_size = 48 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0030 000a auth_len : 0000 000c call_id : 00000007 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 00000018 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 0 smbtrans read: 48 rpc_api_pipe: fragment first and last both set 000018 samr_io_r_open_domain 000018 smb_io_pol_hnd domain_pol 0018 data1: 00000000 001c data2: 2215bc13 0020 data3: 3d4e 0022 data4: 4cf4 0024 data5: 9f 0f 69 b7 26 98 d3 0f 002c status: 00000000 init_samr_q_enum_dom_groups 000000 samr_io_q_enum_dom_groups 000000 smb_io_pol_hnd pol 0000 data1: 00000000 0004 data2: 2215bc13 0008 data3: 3d4e 000a data4: 4cf4 000c data5: 9f 0f 69 b7 26 98 d3 0f 0014 start_idx: 00000000 0018 max_size : 00008000 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0xb data_len: 0x34 create_rpc_request: data_len: 34 auth_len: 0 alloc_hint: 24 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 0034 000a auth_len : 0000 000c call_id : 00000008 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 00000024 0014 context_id: 0000 0016 opnum : 000b data_len: 34 data_calc_len: 34 rpc_api_pipe: cmd:26 fnum:80a size=134 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=52 (0x34) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=52 (0x34) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2058 (0x80A) smb_bcc=67 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 34 00 00 00 08 00 00 00 24 .......4 .......$ [020] 00 00 00 00 00 0B 00 00 00 00 00 13 BC 15 22 4E ........ ......"N [030] 3D F4 4C 9F 0F 69 B7 26 98 D3 0F 00 00 00 00 00 =.L..i.& ........ [040] 80 00 00 ... write_socket(11,138) write_socket(11,138) wrote 138 got smb length of 108 size=108 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=52 (0x34) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=53 [000] 34 05 00 02 03 10 00 00 00 C0 01 00 00 08 00 00 4....... ........ [010] 00 A8 01 00 00 00 00 00 00 08 00 00 00 18 2A 17 ........ ......*. [020] 00 08 00 00 00 78 A5 14 00 08 00 00 00 00 02 00 .....x.. ........ [030] 00 1A 00 20 00 ... . size=108 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=52 (0x34) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=52 (0x34) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=53 [000] 34 05 00 02 03 10 00 00 00 C0 01 00 00 08 00 00 4....... ........ [010] 00 A8 01 00 00 00 00 00 00 08 00 00 00 18 2A 17 ........ ......*. [020] 00 08 00 00 00 78 A5 14 00 08 00 00 00 00 02 00 .....x.. ........ [030] 00 1A 00 20 00 ... . rpc_check_hdr: rdata->data_size = 52 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 01c0 000a auth_len : 0000 000c call_id : 00000008 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 000001a8 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 396 smbtrans read: 52 rpc_read: data_to_read: 396 rdata offset: 52 extra_data_size: 396 rpc_read: grew buffer by 396 bytes to 448 write_socket(11,59) write_socket(11,59) wrote 59 got smb length of 456 size=456 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4101 smb_pid=17005 smb_uid=2051 smb_mid=1 smt_wct=12 smb_vwv[0]=255 (0xFF) smb_vwv[1]=0 (0x0) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=0 (0x0) smb_vwv[5]=396 (0x18C) smb_vwv[6]=60 (0x3C) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_bcc=397 [000] 03 C0 64 1C 00 02 02 00 00 1A 00 20 00 28 66 1C ..d..... ... .(f. [010] 00 01 02 00 00 18 00 20 00 20 64 1C 00 6B 04 00 ....... . d..k.. [020] 00 08 00 20 00 C8 63 1C 00 FA 03 00 00 32 00 32 ... ..c. .....2.2 [030] 00 A8 AF 1C 00 1A 05 00 00 14 00 20 00 70 63 1C ........ ... .pc. [040] 00 F0 03 00 00 06 00 20 00 48 63 1C 00 AB 05 00 ....... .Hc..... [050] 00 22 00 22 00 C0 62 1C 00 10 00 00 00 00 00 00 ."."..b. ........ [060] 00 0D 00 00 00 44 00 6F 00 6D 00 61 00 69 00 6E .....D.o .m.a.i.n [070] 00 20 00 41 00 64 00 6D 00 69 00 6E 00 73 00 00 . .A.d.m .i.n.s.. [080] 00 10 00 00 00 00 00 00 00 0D 00 00 00 44 00 6F ........ .....D.o [090] 00 6D 00 61 00 69 00 6E 00 20 00 47 00 75 00 65 .m.a.i.n . .G.u.e [0A0] 00 73 00 74 00 73 00 9A BF 10 00 00 00 00 00 00 .s.t.s.. ........ [0B0] 00 0C 00 00 00 44 00 6F 00 6D 00 61 00 69 00 6E .....D.o .m.a.i.n [0C0] 00 20 00 55 00 73 00 65 00 72 00 73 00 10 00 00 . .U.s.e .r.s.... [0D0] 00 00 00 00 00 04 00 00 00 4D 00 49 00 53 00 32 ........ .M.I.S.2 [0E0] 00 19 00 00 00 00 00 00 00 19 00 00 00 4D 00 54 ........ .....M.T [0F0] 00 53 00 20 00 54 00 72 00 75 00 73 00 74 00 65 .S. .T.r .u.s.t.e [100] 00 64 00 20 00 49 00 6D 00 70 00 65 00 72 00 73 .d. .I.m .p.e.r.s [110] 00 6F 00 6E 00 61 00 74 00 6F 00 72 00 73 00 30 .o.n.a.t .o.r.s.0 [120] C6 10 00 00 00 00 00 00 00 0A 00 00 00 50 00 75 ........ .....P.u [130] 00 72 00 63 00 68 00 61 00 73 00 69 00 6E 00 67 .r.c.h.a .s.i.n.g [140] 00 10 00 00 00 00 00 00 00 03 00 00 00 52 00 41 ........ .....R.A [150] 00 53 00 14 00 11 00 00 00 00 00 00 00 11 00 00 .S...... ........ [160] 00 53 00 4D 00 53 00 49 00 6E 00 74 00 65 00 72 .S.M.S.I .n.t.e.r [170] 00 6E 00 61 00 6C 00 43 00 6C 00 69 00 47 00 72 .n.a.l.C .l.i.G.r [180] 00 70 00 00 00 08 00 00 00 00 00 00 00 .p...... ..... rpc_read: num_read = 396, read offset: 0, to read: 396 rpc_api_pipe: fragment first and last both set 000018 samr_io_r_enum_dom_groups 0018 next_idx : 00000008 001c ptr_entries1: 00172a18 0020 num_entries2: 00000008 0024 ptr_entries2: 0014a578 0028 num_entries3: 00000008 00002c sam_io_sam_entry 002c rid: 00000200 000030 smb_io_unihdr unihdr 0030 uni_str_len: 001a 0032 uni_max_len: 0020 0034 buffer : 001c64c0 000038 sam_io_sam_entry 0038 rid: 00000202 00003c smb_io_unihdr unihdr 003c uni_str_len: 001a 003e uni_max_len: 0020 0040 buffer : 001c6628 000044 sam_io_sam_entry 0044 rid: 00000201 000048 smb_io_unihdr unihdr 0048 uni_str_len: 0018 004a uni_max_len: 0020 004c buffer : 001c6420 000050 sam_io_sam_entry 0050 rid: 0000046b 000054 smb_io_unihdr unihdr 0054 uni_str_len: 0008 0056 uni_max_len: 0020 0058 buffer : 001c63c8 00005c sam_io_sam_entry 005c rid: 000003fa 000060 smb_io_unihdr unihdr 0060 uni_str_len: 0032 0062 uni_max_len: 0032 0064 buffer : 001cafa8 000068 sam_io_sam_entry 0068 rid: 0000051a 00006c smb_io_unihdr unihdr 006c uni_str_len: 0014 006e uni_max_len: 0020 0070 buffer : 001c6370 000074 sam_io_sam_entry 0074 rid: 000003f0 000078 smb_io_unihdr unihdr 0078 uni_str_len: 0006 007a uni_max_len: 0020 007c buffer : 001c6348 000080 sam_io_sam_entry 0080 rid: 000005ab 000084 smb_io_unihdr unihdr 0084 uni_str_len: 0022 0086 uni_max_len: 0022 0088 buffer : 001c62c0 00008c smb_io_unistr2 008c uni_max_len: 00000010 0090 undoc : 00000000 0094 uni_str_len: 0000000d 0098 buffer : D.o.m.a.i.n. .A.d.m.i.n.s. 0000b2 smb_io_unistr2 00b4 uni_max_len: 00000010 00b8 undoc : 00000000 00bc uni_str_len: 0000000d 00c0 buffer : D.o.m.a.i.n. .G.u.e.s.t.s. 0000da smb_io_unistr2 00dc uni_max_len: 00000010 00e0 undoc : 00000000 00e4 uni_str_len: 0000000c 00e8 buffer : D.o.m.a.i.n. .U.s.e.r.s. 000100 smb_io_unistr2 0100 uni_max_len: 00000010 0104 undoc : 00000000 0108 uni_str_len: 00000004 010c buffer : M.I.S.2. 000114 smb_io_unistr2 0114 uni_max_len: 00000019 0118 undoc : 00000000 011c uni_str_len: 00000019 0120 buffer : M.T.S. .T.r.u.s.t.e.d. .I.m.p.e.r.s.o.n.a.t.o.r.s. 000152 smb_io_unistr2 0154 uni_max_len: 00000010 0158 undoc : 00000000 015c uni_str_len: 0000000a 0160 buffer : P.u.r.c.h.a.s.i.n.g. 000174 smb_io_unistr2 0174 uni_max_len: 00000010 0178 undoc : 00000000 017c uni_str_len: 00000003 0180 buffer : R.A.S. 000186 smb_io_unistr2 0188 uni_max_len: 00000011 018c undoc : 00000000 0190 uni_str_len: 00000011 0194 buffer : S.M.S.I.n.t.e.r.n.a.l.C.l.i.G.r.p. 01b8 num_entries4: 00000008 01bc status: 00000000 read failed on sock 10, pid 17006: EOF accepted socket 10 establishing connections server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=IMT_BDC, got_sid=1, sam_hnd=1 sam_dom_hnd=1 server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=IMT_BDC, got_sid=1, sam_hnd=1 sam_dom_hnd=1 [17008]: lookupsid S-1-5-21-1563037056-1694922919-879972363-1177 string_to_sid: converted SID S-1-5-21-1563037056-1694922919-879972363-1177 ok init_r_enum_trust_dom init_lsa_sid_enum 000000 lsa_io_q_lookup_sids 000000 smb_io_pol_hnd pol_hnd 0000 data1: 00000000 0004 data2: fe788842 0008 data3: e656 000a data4: 4f2c 000c data5: a3 db b6 20 4e fc e2 08 000014 lsa_io_sid_enum sids 0014 num_entries : 00000001 0018 ptr_sid_enum: 00000001 001c num_entries2: 00000001 0020 ptr_sid[0]: 00000001 000024 smb_io_dom_sid2 sid[0] 0024 num_auths: 00000005 000028 smb_io_dom_sid sid 0028 sid_rev_num: 01 0029 num_auths : 05 002a id_auth[0] : 00 002b id_auth[1] : 00 002c id_auth[2] : 00 002d id_auth[3] : 00 002e id_auth[4] : 00 002f id_auth[5] : 05 0030 sub_auths : 00000015 5d2a0d80 650678a7 3473500b 00000499 000044 lsa_io_trans_names names 0044 num_entries : 00000000 0048 ptr_trans_names: 00000000 00004c smb_io_lookup_level switch 004c value: 0001 0050 mapped_count: 00000000 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0xf data_len: 0x6c create_rpc_request: data_len: 6c auth_len: 0 alloc_hint: 5c 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 006c 000a auth_len : 0000 000c call_id : 00000009 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000005c 0014 context_id: 0000 0016 opnum : 000f data_len: 6c data_calc_len: 6c rpc_api_pipe: cmd:26 fnum:816 size=190 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=108 (0x6C) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=108 (0x6C) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=123 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 6C 00 00 00 09 00 00 00 5C .......l .......\ [020] 00 00 00 00 00 0F 00 00 00 00 00 42 88 78 FE 56 ........ ...B.x.V [030] E6 2C 4F A3 DB B6 20 4E FC E2 08 01 00 00 00 01 .,O... N ........ [040] 00 00 00 01 00 00 00 01 00 00 00 05 00 00 00 01 ........ ........ [050] 05 00 00 00 00 00 05 15 00 00 00 80 0D 2A 5D A7 ........ .....*]. [060] 78 06 65 0B 50 73 34 99 04 00 00 00 00 00 00 00 x.e.Ps4. ........ [070] 00 00 00 01 00 00 00 00 00 00 00 ........ ... write_socket(7,194) write_socket(7,194) wrote 194 got smb length of 164 size=164 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=108 (0x6C) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=109 [000] 6C 05 00 02 03 10 00 00 00 B4 00 00 00 09 00 00 l....... ........ [010] 00 9C 00 00 00 00 00 00 00 50 0A 1B 00 01 00 00 ........ .P...... [020] 00 28 88 1A 00 20 00 00 00 01 00 00 00 12 00 14 .(... .. ........ [030] 00 B8 C0 15 00 10 00 1B 00 0A 00 00 00 00 00 00 ........ ........ [040] 00 09 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .....F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 05 04 00 00 00 01 04 00 .E.L.D.. ........ [060] 00 00 00 00 05 15 00 00 00 80 0D 2A 5D ........ ...*] size=164 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=108 (0x6C) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=109 [000] 6C 05 00 02 03 10 00 00 00 B4 00 00 00 09 00 00 l....... ........ [010] 00 9C 00 00 00 00 00 00 00 50 0A 1B 00 01 00 00 ........ .P...... [020] 00 28 88 1A 00 20 00 00 00 01 00 00 00 12 00 14 .(... .. ........ [030] 00 B8 C0 15 00 10 00 1B 00 0A 00 00 00 00 00 00 ........ ........ [040] 00 09 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .....F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 05 04 00 00 00 01 04 00 .E.L.D.. ........ [060] 00 00 00 00 05 15 00 00 00 80 0D 2A 5D ........ ...*] rpc_check_hdr: rdata->data_size = 108 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 00b4 000a auth_len : 0000 000c call_id : 00000009 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 0000009c 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 72 smbtrans read: 108 rpc_read: data_to_read: 72 rdata offset: 108 extra_data_size: 72 rpc_read: grew buffer by 72 bytes to 180 write_socket(7,59) write_socket(7,59) wrote 59 got smb length of 132 size=132 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=12 smb_vwv[0]=255 (0xFF) smb_vwv[1]=0 (0x0) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=0 (0x0) smb_vwv[5]=72 (0x48) smb_vwv[6]=60 (0x3C) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_bcc=73 [000] 03 A7 78 06 65 0B 50 73 34 01 00 00 00 F0 62 1C ..x.e.Ps 4.....b. [010] 00 01 00 00 00 04 00 00 00 0E 00 0E 00 28 21 1B ........ .....(!. [020] 00 00 00 00 00 07 00 00 00 00 00 00 00 07 00 00 ........ ........ [030] 00 63 00 61 00 64 00 72 00 65 00 61 00 64 00 6D .c.a.d.r .e.a.d.m [040] 00 01 00 00 00 00 00 00 00 ........ . rpc_read: num_read = 72, read offset: 0, to read: 72 rpc_api_pipe: fragment first and last both set 000018 lsa_io_r_lookup_sids 0018 ptr_dom_ref: 001b0a50 00001c lsa_io_dom_r_ref dom_ref 001c num_ref_doms_1: 00000001 0020 ptr_ref_dom : 001a8828 0024 max_entries : 00000020 0028 num_ref_doms_2: 00000001 00002c smb_io_unihdr dom_ref[0] 002c uni_str_len: 0012 002e uni_max_len: 0014 0030 buffer : 0015c0b8 0034 sid_ptr[0] : 001b0010 000038 smb_io_unistr2 dom_ref[0] 0038 uni_max_len: 0000000a 003c undoc : 00000000 0040 uni_str_len: 00000009 0044 buffer : F.A.I.R.F.I.E.L.D. 000058 smb_io_dom_sid2 sid_ptr[0] 0058 num_auths: 00000004 00005c smb_io_dom_sid sid 005c sid_rev_num: 01 005d num_auths : 04 005e id_auth[0] : 00 005f id_auth[1] : 00 0060 id_auth[2] : 00 0061 id_auth[3] : 00 0062 id_auth[4] : 00 0063 id_auth[5] : 05 0064 sub_auths : 00000015 5d2a0d80 650678a7 3473500b 000074 lsa_io_trans_names names 0074 num_entries : 00000001 0078 ptr_trans_names: 001c62f0 007c num_entries2 : 00000001 000080 lsa_io_trans_name name[0] 0080 sid_name_use: 0004 000084 smb_io_unihdr hdr_name 0084 uni_str_len: 000e 0086 uni_max_len: 000e 0088 buffer : 001b2128 008c domain_idx : 00000000 000090 smb_io_unistr2 name[0] 0090 uni_max_len: 00000007 0094 undoc : 00000000 0098 uni_str_len: 00000007 009c buffer : c.a.d.r.e.a.d. 00ac mapped_count: 00000001 00b0 status : 00000000 read failed on sock 10, pid 17008: EOF establishing connections server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=IMT_BDC, got_sid=1, sam_hnd=1 sam_dom_hnd=1 server: dc=IMT_BDC, pwdb_init=1, lsa_hnd=1 INTERMEC: dc=, got_sid=0, sam_hnd=0 sam_dom_hnd=0 FAIRFIELD: dc=IMT_BDC, got_sid=1, sam_hnd=1 sam_dom_hnd=1 accepted socket 10 [17009]: lookupsid S-1-5-21-1563037056-1694922919-879972363-1176 string_to_sid: converted SID S-1-5-21-1563037056-1694922919-879972363-1176 ok init_r_enum_trust_dom init_lsa_sid_enum 000000 lsa_io_q_lookup_sids 000000 smb_io_pol_hnd pol_hnd 0000 data1: 00000000 0004 data2: fe788842 0008 data3: e656 000a data4: 4f2c 000c data5: a3 db b6 20 4e fc e2 08 000014 lsa_io_sid_enum sids 0014 num_entries : 00000001 0018 ptr_sid_enum: 00000001 001c num_entries2: 00000001 0020 ptr_sid[0]: 00000001 000024 smb_io_dom_sid2 sid[0] 0024 num_auths: 00000005 000028 smb_io_dom_sid sid 0028 sid_rev_num: 01 0029 num_auths : 05 002a id_auth[0] : 00 002b id_auth[1] : 00 002c id_auth[2] : 00 002d id_auth[3] : 00 002e id_auth[4] : 00 002f id_auth[5] : 05 0030 sub_auths : 00000015 5d2a0d80 650678a7 3473500b 00000498 000044 lsa_io_trans_names names 0044 num_entries : 00000000 0048 ptr_trans_names: 00000000 00004c smb_io_lookup_level switch 004c value: 0001 0050 mapped_count: 00000000 rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes.... create_rpc_request: opnum: 0xf data_len: 0x6c create_rpc_request: data_len: 6c auth_len: 0 alloc_hint: 5c 000000 smb_io_rpc_hdr hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 00 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 006c 000a auth_len : 0000 000c call_id : 0000000a 000010 smb_io_rpc_hdr_req hdr_req 0010 alloc_hint: 0000005c 0014 context_id: 0000 0016 opnum : 000f data_len: 6c data_calc_len: 6c rpc_api_pipe: cmd:26 fnum:816 size=190 smb_com=0x25 smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=8 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=16 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=108 (0x6C) smb_vwv[4]=0 (0x0) smb_vwv[5]=0 (0x0) smb_vwv[6]=0 (0x0) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=82 (0x52) smb_vwv[11]=108 (0x6C) smb_vwv[12]=82 (0x52) smb_vwv[13]=2 (0x2) smb_vwv[14]=38 (0x26) smb_vwv[15]=2070 (0x816) smb_bcc=123 [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... [010] 00 00 03 10 00 00 00 6C 00 00 00 0A 00 00 00 5C .......l .......\ [020] 00 00 00 00 00 0F 00 00 00 00 00 42 88 78 FE 56 ........ ...B.x.V [030] E6 2C 4F A3 DB B6 20 4E FC E2 08 01 00 00 00 01 .,O... N ........ [040] 00 00 00 01 00 00 00 01 00 00 00 05 00 00 00 01 ........ ........ [050] 05 00 00 00 00 00 05 15 00 00 00 80 0D 2A 5D A7 ........ .....*]. [060] 78 06 65 0B 50 73 34 98 04 00 00 00 00 00 00 00 x.e.Ps4. ........ [070] 00 00 00 01 00 00 00 00 00 00 00 ........ ... write_socket(7,194) write_socket(7,194) wrote 194 got smb length of 164 size=164 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=108 (0x6C) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=109 [000] 6C 05 00 02 03 10 00 00 00 B8 00 00 00 0A 00 00 l....... ........ [010] 00 A0 00 00 00 00 00 00 00 C8 00 40 0F 01 00 00 ........ ...@.... [020] 00 28 88 1A 00 20 00 00 00 01 00 00 00 12 00 14 .(... .. ........ [030] 00 10 45 1D 00 C8 F5 19 00 0A 00 00 00 00 00 00 ..E..... ........ [040] 00 09 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .....F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 05 04 00 00 00 01 04 00 .E.L.D.. ........ [060] 00 00 00 00 05 15 00 00 00 80 0D 2A 5D ........ ...*] size=164 smb_com=0x25 smb_rcls=1 smb_reh=0 smb_err=234 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=10 smb_vwv[0]=0 (0x0) smb_vwv[1]=108 (0x6C) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=56 (0x38) smb_vwv[5]=0 (0x0) smb_vwv[6]=108 (0x6C) smb_vwv[7]=56 (0x38) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_bcc=109 [000] 6C 05 00 02 03 10 00 00 00 B8 00 00 00 0A 00 00 l....... ........ [010] 00 A0 00 00 00 00 00 00 00 C8 00 40 0F 01 00 00 ........ ...@.... [020] 00 28 88 1A 00 20 00 00 00 01 00 00 00 12 00 14 .(... .. ........ [030] 00 10 45 1D 00 C8 F5 19 00 0A 00 00 00 00 00 00 ..E..... ........ [040] 00 09 00 00 00 46 00 41 00 49 00 52 00 46 00 49 .....F.A .I.R.F.I [050] 00 45 00 4C 00 44 00 00 05 04 00 00 00 01 04 00 .E.L.D.. ........ [060] 00 00 00 00 05 15 00 00 00 80 0D 2A 5D ........ ...*] rpc_check_hdr: rdata->data_size = 108 000000 smb_io_rpc_hdr rpc_hdr 0000 major : 05 0001 minor : 00 0002 pkt_type : 02 0003 flags : 03 0004 pack_type0: 10 0005 pack_type1: 00 0006 pack_type2: 00 0007 pack_type3: 00 0008 frag_len : 00b8 000a auth_len : 0000 000c call_id : 0000000a 000010 smb_io_rpc_hdr_resp rpc_hdr_resp 0010 alloc_hint: 000000a0 0014 context_id: 0000 0016 cancel_ct : 00 0017 reserved : 00 rpc_api_pipe: len left: 76 smbtrans read: 108 rpc_read: data_to_read: 76 rdata offset: 108 extra_data_size: 76 rpc_read: grew buffer by 76 bytes to 184 write_socket(7,59) write_socket(7,59) wrote 59 got smb length of 136 size=136 smb_com=0x2e smb_rcls=0 smb_reh=0 smb_err=0 smb_flg=136 smb_flg2=32769 smb_tid=4097 smb_pid=17005 smb_uid=4099 smb_mid=1 smt_wct=12 smb_vwv[0]=255 (0xFF) smb_vwv[1]=0 (0x0) smb_vwv[2]=0 (0x0) smb_vwv[3]=0 (0x0) smb_vwv[4]=0 (0x0) smb_vwv[5]=76 (0x4C) smb_vwv[6]=60 (0x3C) smb_vwv[7]=0 (0x0) smb_vwv[8]=0 (0x0) smb_vwv[9]=0 (0x0) smb_vwv[10]=0 (0x0) smb_vwv[11]=0 (0x0) smb_bcc=77 [000] 03 A7 78 06 65 0B 50 73 34 01 00 00 00 F0 62 1C ..x.e.Ps 4.....b. [010] 00 01 00 00 00 04 00 00 00 12 00 12 00 10 00 1B ........ ........ [020] 00 00 00 00 00 09 00 00 00 00 00 00 00 09 00 00 ........ ........ [030] 00 43 00 61 00 64 00 63 00 72 00 65 00 61 00 74 .C.a.d.c .r.e.a.t [040] 00 65 00 00 00 01 00 00 00 00 00 00 00 .e...... ..... rpc_read: num_read = 76, read offset: 0, to read: 76 rpc_api_pipe: fragment first and last both set 000018 lsa_io_r_lookup_sids 0018 ptr_dom_ref: 0f4000c8 00001c lsa_io_dom_r_ref dom_ref 001c num_ref_doms_1: 00000001 0020 ptr_ref_dom : 001a8828 0024 max_entries : 00000020 0028 num_ref_doms_2: 00000001 00002c smb_io_unihdr dom_ref[0] 002c uni_str_len: 0012 002e uni_max_len: 0014 0030 buffer : 001d4510 0034 sid_ptr[0] : 0019f5c8 000038 smb_io_unistr2 dom_ref[0] 0038 uni_max_len: 0000000a 003c undoc : 00000000 0040 uni_str_len: 00000009 0044 buffer : F.A.I.R.F.I.E.L.D. 000058 smb_io_dom_sid2 sid_ptr[0] 0058 num_auths: 00000004 00005c smb_io_dom_sid sid 005c sid_rev_num: 01 005d num_auths : 04 005e id_auth[0] : 00 005f id_auth[1] : 00 0060 id_auth[2] : 00 0061 id_auth[3] : 00 0062 id_auth[4] : 00 0063 id_auth[5] : 05 0064 sub_auths : 00000015 5d2a0d80 650678a7 3473500b 000074 lsa_io_trans_names names 0074 num_entries : 00000001 0078 ptr_trans_names: 001c62f0 007c num_entries2 : 00000001 000080 lsa_io_trans_name name[0] 0080 sid_name_use: 0004 000084 smb_io_unihdr hdr_name 0084 uni_str_len: 0012 0086 uni_max_len: 0012 0088 buffer : 001b0010 008c domain_idx : 00000000 000090 smb_io_unistr2 name[0] 0090 uni_max_len: 00000009 0094 undoc : 00000000 0098 uni_str_len: 00000009 009c buffer : C.a.d.c.r.e.a.t.e. 00b0 mapped_count: 00000001 00b4 status : 00000000 read failed on sock 10, pid 17009: EOF -- Daniel Deimert (d1dd@dtek.chalmers.se) -*- http://www.dtek.chalmers.se/~d1dd/