Hello,
I have been trying for 3 days now to get smbpasswd to join my existing NT 4.0
domain, without success. The command I run is "smbpasswd -j CCH -r
chrivdc01 -U
knoxth" (yes, userid knoxth has Administrative access). No luck. I've
included
the output of adding -D 3 to the options line.
Can anyone help me figure out what is happening??
Thanks!
Tom
----- Forwarded by Thomas Knox/CCHUS on 12/13/01 08:56 AM -----
|--------+-------------------------->
| | Thomas Knox CCH |
| | RIV |
| | <knoxth@chrivh19|
| | b.cch.com> |
| | |
| | 12/13/01 07:47 |
| | AM |
| | |
|--------+-------------------------->
>----------------------------------------------------------------------------|
| |
| To: Thomas Knox/CCHUS@Computax |
| cc: |
| Subject: smbpasswd |
>----------------------------------------------------------------------------|
INFO: Debug class all level = 3 (pid 23279 from pid 23279)
added interface ip=165.181.28.19 bcast=165.181.28.63 nmask=255.255.255.192
cli_init_creds: user knoxth domain CCH flgs: 0
ntlmssp_cli_flgs:0
resolve_srv_name: CHRIVDC01
resolve_lmhosts: Attempting lmhosts lookup for name CHRIVDC01<0x20>
getlmhostsent: lmhost entry: 165.181.122.48 CHRIVDC01#20
cli_establish_connection: CHRIVH19B<00> connecting to CHRIVDC01<20>
(165.181.122.48) - knoxth [CCH]
Connecting to 165.181.122.48 at port 139
socket option SO_KEEPALIVE = 0
socket option SO_REUSEADDR = 0
socket option SO_BROADCAST = 0
socket option TCP_NODELAY = 1
socket option IPTOS_LOWDELAY = 0
socket option IPTOS_THROUGHPUT = 0
socket option SO_SNDBUF = 8192
socket option SO_RCVBUF = 8760
Could not test socket option SO_SNDLOWAT.
Could not test socket option SO_RCVLOWAT.
Could not test socket option SO_SNDTIMEO.
Could not test socket option SO_RCVTIMEO.
write_socket(4,76)
write_socket(4,76) wrote 76
Sent session request
got smb length of 0
size=0
smb_com=0x0
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=0
smb_flg2=0
smb_tid=0
smb_pid=0
smb_uid=0
smb_mid=0
smt_wct=0
smb_bcc=0
write_socket(4,168)
write_socket(4,168) wrote 168
got smb length of 85
size=85
smb_com=0x72
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=23279
smb_uid=0
smb_mid=1
smt_wct=17
smb_vwv[0]=7 (0x7)
smb_vwv[1]=12803 (0x3203)
smb_vwv[2]=256 (0x100)
smb_vwv[3]=1024 (0x400)
smb_vwv[4]=17 (0x11)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=256 (0x100)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=64768 (0xFD00)
smb_vwv[10]=67 (0x43)
smb_vwv[11]=20480 (0x5000)
smb_vwv[12]=19387 (0x4BBB)
smb_vwv[13]=56468 (0xDC94)
smb_vwv[14]=49539 (0xC183)
smb_vwv[15]=26625 (0x6801)
smb_vwv[16]=2049 (0x801)
smb_bcc=16
[000] BF 89 ED 06 A1 42 F7 44 43 00 43 00 48 00 00 00 .....B.D C.C.H...
size=85
smb_com=0x72
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=1
smb_tid=0
smb_pid=23279
smb_uid=0
smb_mid=1
smt_wct=17
smb_vwv[0]=7 (0x7)
smb_vwv[1]=12803 (0x3203)
smb_vwv[2]=256 (0x100)
smb_vwv[3]=1024 (0x400)
smb_vwv[4]=17 (0x11)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=256 (0x100)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=64768 (0xFD00)
smb_vwv[10]=67 (0x43)
smb_vwv[11]=20480 (0x5000)
smb_vwv[12]=19387 (0x4BBB)
smb_vwv[13]=56468 (0xDC94)
smb_vwv[14]=49539 (0xC183)
smb_vwv[15]=26625 (0x6801)
smb_vwv[16]=2049 (0x801)
smb_bcc=16
[000] BF 89 ED 06 A1 42 F7 44 43 00 43 00 48 00 00 00 .....B.D C.C.H...
write_socket(4,158)
write_socket(4,158) wrote 158
got smb length of 118
size=118
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=0
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=118 (0x76)
smb_vwv[2]=0 (0x0)
smb_bcc=77
[000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s.
[010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N
[020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a
[030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4..
[040] 00 30 00 00 00 43 00 43 00 48 00 00 00 .0...C.C .H...
size=118
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=0
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=118 (0x76)
smb_vwv[2]=0 (0x0)
smb_bcc=77
[000] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s.
[010] 00 4E 00 54 00 20 00 34 00 2E 00 30 00 00 00 4E .N.T. .4 ...0...N
[020] 00 54 00 20 00 4C 00 41 00 4E 00 20 00 4D 00 61 .T. .L.A .N. .M.a
[030] 00 6E 00 61 00 67 00 65 00 72 00 20 00 34 00 2E .n.a.g.e .r. .4..
[040] 00 30 00 00 00 43 00 43 00 48 00 00 00 .0...C.C .H...
session setup ok
Domain=[CCH] OS=[Windows NT 4.0] Server=[NT LAN Manager 4.0]
write_socket(4,86)
write_socket(4,86) wrote 86
got smb length of 48
size=48
smb_com=0x75
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=3
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=1 (0x1)
smb_bcc=7
[000] 49 50 43 00 00 00 00 IPC....
write_socket(4,104)
write_socket(4,104) wrote 104
got smb length of 103
size=103
smb_com=0xa2
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=34
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=103 (0x67)
smb_vwv[2]=2560 (0xA00)
smb_vwv[3]=288 (0x120)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=0 (0x0)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=0 (0x0)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=32768 (0x8000)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=0 (0x0)
smb_vwv[24]=16 (0x10)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=0 (0x0)
smb_vwv[29]=0 (0x0)
smb_vwv[30]=0 (0x0)
smb_vwv[31]=512 (0x200)
smb_vwv[32]=65280 (0xFF00)
smb_vwv[33]=5 (0x5)
smb_bcc=0
Bind RPC Pipe[200a]: \PIPE\lsarpc
Bind Abstract Syntax: [000] 12 34 57 78 12 34 AB CD EF 00 01 23 45 67 89 AB
.4Wx.4.. ...#Eg..
[010] 00 00 00 00 ....
Bind Transfer Syntax: [000] 8A 88 5D 04 1C EB 11 C9 9F E8 08 00 2B 10 48 60
..]..... ....+.H`
[010] 00 00 00 02 ....
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 0b
0003 flags : 00
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0048
000a auth_len : 0000
000c call_id : 00000001
000010 smb_io_rpc_hdr_rb
000010 smb_io_rpc_hdr_bba
0010 max_tsize: 1630
0012 max_rsize: 1630
0014 assoc_gid: 00000000
0018 num_elements: 00000001
001c context_id : 0000
001e num_syntaxes: 01
00001f smb_io_rpc_iface
0020 data : 12345778
0024 data : 1234
0026 data : abcd
0028 data : ef 00 01 23 45 67 89 ab
0030 version: 00000000
000034 smb_io_rpc_iface
0034 data : 8a885d04
0038 data : 1ceb
003a data : 11c9
003c data : 9f e8 08 00 2b 10 48 60
0044 version: 00000002
rpc_api_pipe: cmd:26 fnum:200a
size=154
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=72 (0x48)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=72 (0x48)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=72 (0x48)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8202 (0x200A)
smb_bcc=87
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 0B 00 10 00 00 00 48 00 00 00 01 00 00 00 30 .......H .......0
[020] 16 30 16 00 00 00 00 01 00 00 00 00 00 01 00 78 .0...... .......x
[030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg...
[040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+
[050] 10 48 60 02 00 00 00 .H`....
write_socket(4,158)
write_socket(4,158) wrote 158
got smb length of 124
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
[000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D......
[010] 00 30 16 30 16 6F D4 00 00 0C 00 5C 50 49 50 45 .0.0.o.. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
[000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 H....... .D......
[010] 00 30 16 30 16 6F D4 00 00 0C 00 5C 50 49 50 45 .0.0.o.. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
rpc_check_hdr: rdata->data_size = 68
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 0c
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0044
000a auth_len : 0000
000c call_id : 00000001
rpc_api_pipe: len left: 0 smbtrans read: 68
rpc_api_pipe: fragment first and last both set
rpc_pipe_bind: rpc_api_pipe returned OK.
000010 smb_io_rpc_hdr_ba
000010 smb_io_rpc_hdr_bba
0010 max_tsize: 1630
0012 max_rsize: 1630
0014 assoc_gid: 0000d46f
000018 smb_io_rpc_addr_str
0018 len: 000c
001a str: \PIPE\lsass.
000026 smb_io_rpc_results
0028 num_results: 01
002c result : 0000
002e reason : 0000
000030 smb_io_rpc_iface
0030 data : 8a885d04
0034 data : 1ceb
0036 data : 11c9
0038 data : 9f e8 08 00 2b 10 48 60
0040 version: 00000002
bind_rpc_pipe: server pipe_name found: \PIPE\lsass
bind_rpc_pipe: accepted!
init_lsa_sec_qos
init_open_pol: attr:0 da:33554432
init_lsa_obj_attr
000000 lsa_io_q_open_pol
0000 ptr : 00000001
0004 system_name: 005c
000008 lsa_io_obj_attr
0008 len : 00000018
000c ptr_root_dir: 00000000
0010 ptr_obj_name: 00000000
0014 attributes : 00000000
0018 ptr_sec_desc: 00000000
001c ptr_sec_qos : 00000001
000020 lsa_io_obj_qos sec_qos
0020 len : 0000000c
0024 sec_imp_level : 0002
0026 sec_ctxt_mode : 01
0027 effective_only: 00
0028 unknown : 02000000
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x6 data_len: 0x44
create_rpc_request: data_len: 44 auth_len: 0 alloc_hint: 34
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0044
000a auth_len : 0000
000c call_id : 00000002
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 00000034
0014 context_id: 0000
0016 opnum : 0006
data_len: 44 data_calc_len: 44
rpc_api_pipe: cmd:26 fnum:200a
size=150
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=68 (0x44)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=68 (0x44)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8202 (0x200A)
smb_bcc=83
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 44 00 00 00 02 00 00 00 34 .......D .......4
[020] 00 00 00 00 00 06 00 01 00 00 00 5C 00 00 00 18 ........ ...\....
[030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[040] 00 00 00 01 00 00 00 0C 00 00 00 02 00 01 00 00 ........ ........
[050] 00 00 02 ...
write_socket(4,154)
write_socket(4,154) wrote 154
got smb length of 104
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 44 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 D....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 2B 36 45 ........ .....+6E
[020] C0 E5 D8 A6 4B B9 15 39 50 AF 14 BC 3D 00 00 00 ....K..9 P...=...
[030] 00 .
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 44 05 00 02 03 10 00 00 00 30 00 00 00 02 00 00 D....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 2B 36 45 ........ .....+6E
[020] C0 E5 D8 A6 4B B9 15 39 50 AF 14 BC 3D 00 00 00 ....K..9 P...=...
[030] 00 .
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0030
000a auth_len : 0000
000c call_id : 00000002
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000018
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
rpc_api_pipe: fragment first and last both set
000018 lsa_io_r_open_pol
000018 smb_io_pol_hnd
0018 data1: 00000000
001c data2: c045362b
0020 data3: d8e5
0022 data4: 4ba6
0024 data5: b9 15 39 50 af 14 bc 3d
002c status: 00000000
init_q_query
000000 lsa_io_q_query
000000 smb_io_pol_hnd
0000 data1: 00000000
0004 data2: c045362b
0008 data3: d8e5
000a data4: 4ba6
000c data5: b9 15 39 50 af 14 bc 3d
0014 info_class: 0005
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x7 data_len: 0x2e
create_rpc_request: data_len: 2e auth_len: 0 alloc_hint: 1e
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 002e
000a auth_len : 0000
000c call_id : 00000003
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 0000001e
0014 context_id: 0000
0016 opnum : 0007
data_len: 2e data_calc_len: 2e
rpc_api_pipe: cmd:26 fnum:200a
size=128
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=46 (0x2E)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=46 (0x2E)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8202 (0x200A)
smb_bcc=61
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 2E 00 00 00 03 00 00 00 1E ........ ........
[020] 00 00 00 00 00 07 00 00 00 00 00 2B 36 45 C0 E5 ........ ...+6E..
[030] D8 A6 4B B9 15 39 50 AF 14 BC 3D 05 00 ..K..9P. ..=..
write_socket(4,132)
write_socket(4,132) wrote 132
got smb length of 102
size=102
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=46 (0x2E)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=47
[000] 2E 05 00 02 03 10 00 00 00 60 00 00 00 03 00 00 ........ .`......
[010] 00 48 00 00 00 00 00 00 00 50 90 16 00 05 00 45 .H...... .P.....E
[020] C0 06 00 08 00 78 41 17 00 F0 8B CA 01 04 00 .....xA. .......
size=102
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=46 (0x2E)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=46 (0x2E)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=47
[000] 2E 05 00 02 03 10 00 00 00 60 00 00 00 03 00 00 ........ .`......
[010] 00 48 00 00 00 00 00 00 00 50 90 16 00 05 00 45 .H...... .P.....E
[020] C0 06 00 08 00 78 41 17 00 F0 8B CA 01 04 00 .....xA. .......
rpc_check_hdr: rdata->data_size = 46
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0060
000a auth_len : 0000
000c call_id : 00000003
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000048
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 50 smbtrans read: 46
rpc_read: data_to_read: 50 rdata offset: 46 extra_data_size: 50
rpc_read: grew buffer by 50 bytes to 96
write_socket(4,59)
write_socket(4,59) wrote 59
got smb length of 110
size=110
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=12
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=50 (0x32)
smb_vwv[6]=60 (0x3C)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_bcc=51
[000] 03 00 00 00 00 00 00 03 00 00 00 43 00 43 00 48 ........ ...C.C.H
[010] 00 48 60 04 00 00 00 01 04 00 00 00 00 00 05 15 .H`..... ........
[020] 00 00 00 5A 2A 9D 32 63 73 BB 67 CF 79 EA 4D 00 ...Z*.2c s.g.y.M.
[030] 00 00 00 ...
rpc_read: num_read = 50, read offset: 0, to read: 50
rpc_api_pipe: fragment first and last both set
000018 lsa_io_r_query
0018 undoc_buffer: 00169050
001c info_class: 0005
000020 lsa_io_dom_query
0020 uni_dom_max_len: 0006
0022 uni_dom_str_len: 0008
0024 buffer_dom_name: 00174178
0028 buffer_dom_sid : 01ca8bf0
00002c smb_io_unistr2 unistr2
002c uni_max_len: 00000004
0030 undoc : 00000000
0034 uni_str_len: 00000003
0038 buffer : C.C.H.
000040 smb_io_dom_sid2
0040 num_auths: 00000004
000044 smb_io_dom_sid sid
0044 sid_rev_num: 01
0045 num_auths : 04
0046 id_auth[0] : 00
0047 id_auth[1] : 00
0048 id_auth[2] : 00
0049 id_auth[3] : 00
004a id_auth[4] : 00
004b id_auth[5] : 05
004c sub_auths : 00000015 329d2a5a 67bb7363 4dea79cf
005c status: 00000000
init_lsa_q_close
000000 lsa_io_q_close
000000 smb_io_pol_hnd
0000 data1: 00000000
0004 data2: c045362b
0008 data3: d8e5
000a data4: 4ba6
000c data5: b9 15 39 50 af 14 bc 3d
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x0 data_len: 0x2c
create_rpc_request: data_len: 2c auth_len: 0 alloc_hint: 1c
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 002c
000a auth_len : 0000
000c call_id : 00000004
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 0000001c
0014 context_id: 0000
0016 opnum : 0000
data_len: 2c data_calc_len: 2c
rpc_api_pipe: cmd:26 fnum:200a
size=126
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=44 (0x2C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=44 (0x2C)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8202 (0x200A)
smb_bcc=59
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 00 1C ......., ........
[020] 00 00 00 00 00 00 00 00 00 00 00 2B 36 45 C0 E5 ........ ...+6E..
[030] D8 A6 4B B9 15 39 50 AF 14 BC 3D ..K..9P.
..write_socket(4,130)
write_socket(4,130) wrote 130
got smb length of 100
size=100
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
[000] 2C 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ,....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ .....
size=100
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
[000] 2C 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ,....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ .....
rpc_check_hdr: rdata->data_size = 44
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0030
000a auth_len : 0000
000c call_id : 00000004
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000018
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 4 smbtrans read: 44
rpc_read: data_to_read: 4 rdata offset: 44 extra_data_size: 4
rpc_read: grew buffer by 4 bytes to 48
write_socket(4,59)
write_socket(4,59) wrote 59
got smb length of 64
size=64
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=12
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=4 (0x4)
smb_vwv[6]=60 (0x3C)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_bcc=5
[000] 03 00 00 00 00 .....
rpc_read: num_read = 4, read offset: 0, to read: 4
rpc_api_pipe: fragment first and last both set
000018 lsa_io_r_close
000018 smb_io_pol_hnd
0018 data1: 00000000
001c data2: 00000000
0020 data3: 0000
0022 data4: 0000
0024 data5: 00 00 00 00 00 00 00 00
002c status: 00000000
write_socket(4,45)
write_socket(4,45) wrote 45
got smb length of 35
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=0
smb_bcc=0
write_socket(4,100)
write_socket(4,100) wrote 100
got smb length of 103
size=103
smb_com=0xa2
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=34
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=103 (0x67)
smb_vwv[2]=2816 (0xB00)
smb_vwv[3]=288 (0x120)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=0 (0x0)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=0 (0x0)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=32768 (0x8000)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=0 (0x0)
smb_vwv[24]=16 (0x10)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=0 (0x0)
smb_vwv[29]=0 (0x0)
smb_vwv[30]=0 (0x0)
smb_vwv[31]=512 (0x200)
smb_vwv[32]=65280 (0xFF00)
smb_vwv[33]=5 (0x5)
smb_bcc=0
Bind RPC Pipe[200b]: \PIPE\samr
Bind Abstract Syntax: [000] 12 34 57 78 12 34 AB CD EF 00 01 23 45 67 89 AC
.4Wx.4.. ...#Eg..
[010] 00 00 00 01 ....
Bind Transfer Syntax: [000] 8A 88 5D 04 1C EB 11 C9 9F E8 08 00 2B 10 48 60
..]..... ....+.H`
[010] 00 00 00 02 ....
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 0b
0003 flags : 00
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0048
000a auth_len : 0000
000c call_id : 00000005
000010 smb_io_rpc_hdr_rb
000010 smb_io_rpc_hdr_bba
0010 max_tsize: 1630
0012 max_rsize: 1630
0014 assoc_gid: 00000000
0018 num_elements: 00000001
001c context_id : 0000
001e num_syntaxes: 01
00001f smb_io_rpc_iface
0020 data : 12345778
0024 data : 1234
0026 data : abcd
0028 data : ef 00 01 23 45 67 89 ac
0030 version: 00000001
000034 smb_io_rpc_iface
0034 data : 8a885d04
0038 data : 1ceb
003a data : 11c9
003c data : 9f e8 08 00 2b 10 48 60
0044 version: 00000002
rpc_api_pipe: cmd:26 fnum:200b
size=154
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=72 (0x48)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=72 (0x48)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=72 (0x48)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8203 (0x200B)
smb_bcc=87
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 0B 00 10 00 00 00 48 00 00 00 05 00 00 00 30 .......H .......0
[020] 16 30 16 00 00 00 00 01 00 00 00 00 00 01 00 78 .0...... .......x
[030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AC 01 W4.4.... ..#Eg...
[040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+
[050] 10 48 60 02 00 00 00 .H`....
write_socket(4,158)
write_socket(4,158) wrote 158
got smb length of 124
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
[000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 05 00 00 H....... .D......
[010] 00 30 16 30 16 70 D4 00 00 0C 00 5C 50 49 50 45 .0.0.p.. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
size=124
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=68 (0x44)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=68 (0x44)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=69
[000] 48 05 00 0C 03 10 00 00 00 44 00 00 00 05 00 00 H....... .D......
[010] 00 30 16 30 16 70 D4 00 00 0C 00 5C 50 49 50 45 .0.0.p.. ...\PIPE
[020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........
[030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H
[040] 60 02 00 00 00 `....
rpc_check_hdr: rdata->data_size = 68
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 0c
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0044
000a auth_len : 0000
000c call_id : 00000005
rpc_api_pipe: len left: 0 smbtrans read: 68
rpc_api_pipe: fragment first and last both set
rpc_pipe_bind: rpc_api_pipe returned OK.
000010 smb_io_rpc_hdr_ba
000010 smb_io_rpc_hdr_bba
0010 max_tsize: 1630
0012 max_rsize: 1630
0014 assoc_gid: 0000d470
000018 smb_io_rpc_addr_str
0018 len: 000c
001a str: \PIPE\lsass.
000026 smb_io_rpc_results
0028 num_results: 01
002c result : 0000
002e reason : 0000
000030 smb_io_rpc_iface
0030 data : 8a885d04
0034 data : 1ceb
0036 data : 11c9
0038 data : 9f e8 08 00 2b 10 48 60
0040 version: 00000002
bind_rpc_pipe: server pipe_name found: \PIPE\lsass
bind_rpc_pipe: accepted!
init_samr_q_connect
000000 samr_io_q_connect
0000 ptr_srv_name: 00000001
000004 smb_io_unistr2
0004 uni_max_len: 0000000a
0008 undoc : 00000000
000c uni_str_len: 0000000a
0010 buffer : C.H.R.I.V.D.C.0.1...
0024 access_mask: 02000000
create_rpc_request: opnum: 0x39 data_len: 0x40
create_rpc_request: data_len: 40 auth_len: 0 alloc_hint: 30
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0040
000a auth_len : 0000
000c call_id : 00000006
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 00000030
0014 context_id: 0000
0016 opnum : 0039
data_len: 40 data_calc_len: 40
rpc_api_pipe: cmd:26 fnum:200b
size=146
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=64 (0x40)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=64 (0x40)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=64 (0x40)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8203 (0x200B)
smb_bcc=79
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 40 00 00 00 06 00 00 00 30 .......@ .......0
[020] 00 00 00 00 00 39 00 01 00 00 00 0A 00 00 00 00 .....9.. ........
[030] 00 00 00 0A 00 00 00 43 00 48 00 52 00 49 00 56 .......C .H.R.I.V
[040] 00 44 00 43 00 30 00 31 00 00 00 00 00 00 02 .D.C.0.1 .......
write_socket(4,150)
write_socket(4,150) wrote 150
got smb length of 104
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 40 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 @....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 E7 F7 58 ........ .......X
[020] 9D 57 70 6B 43 84 CC 4A E2 AE 42 F3 C4 00 00 00 .WpkC..J ..B.....
[030] 00 .
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 40 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 @....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 E7 F7 58 ........ .......X
[020] 9D 57 70 6B 43 84 CC 4A E2 AE 42 F3 C4 00 00 00 .WpkC..J ..B.....
[030] 00 .
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0030
000a auth_len : 0000
000c call_id : 00000006
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000018
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
rpc_api_pipe: fragment first and last both set
000018 samr_io_r_connect
000018 smb_io_pol_hnd connect_pol
0018 data1: 00000000
001c data2: 9d58f7e7
0020 data3: 7057
0022 data4: 436b
0024 data5: 84 cc 4a e2 ae 42 f3 c4
002c status: 00000000
samr_init_samr_q_open_domain
000000 samr_io_q_open_domain
000000 smb_io_pol_hnd pol
0000 data1: 00000000
0004 data2: 9d58f7e7
0008 data3: 7057
000a data4: 436b
000c data5: 84 cc 4a e2 ae 42 f3 c4
0014 flags: 02000000
000018 smb_io_dom_sid2 sid
0018 num_auths: 00000004
00001c smb_io_dom_sid sid
001c sid_rev_num: 01
001d num_auths : 04
001e id_auth[0] : 00
001f id_auth[1] : 00
0020 id_auth[2] : 00
0021 id_auth[3] : 00
0022 id_auth[4] : 00
0023 id_auth[5] : 05
0024 sub_auths : 00000015 329d2a5a 67bb7363 4dea79cf
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x7 data_len: 0x4c
create_rpc_request: data_len: 4c auth_len: 0 alloc_hint: 3c
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 004c
000a auth_len : 0000
000c call_id : 00000007
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 0000003c
0014 context_id: 0000
0016 opnum : 0007
data_len: 4c data_calc_len: 4c
rpc_api_pipe: cmd:26 fnum:200b
size=158
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=76 (0x4C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=76 (0x4C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=76 (0x4C)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8203 (0x200B)
smb_bcc=91
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 4C 00 00 00 07 00 00 00 3C .......L .......<
[020] 00 00 00 00 00 07 00 00 00 00 00 E7 F7 58 9D 57 ........ .....X.W
[030] 70 6B 43 84 CC 4A E2 AE 42 F3 C4 00 00 00 02 04 pkC..J.. B.......
[040] 00 00 00 01 04 00 00 00 00 00 05 15 00 00 00 5A ........ .......Z
[050] 2A 9D 32 63 73 BB 67 CF 79 EA 4D *.2cs.g. y.M
write_socket(4,162)
write_socket(4,162) wrote 162
got smb length of 104
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 4C 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 L....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 0A 50 7E ........ ......P~
[020] EF 7B A5 ED 4D BD 1E 0A EE 9B 5A 7C 57 00 00 00 .{..M... ..Z|W...
[030] 00 .
size=104
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=48 (0x30)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=48 (0x30)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=49
[000] 4C 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 L....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 0A 50 7E ........ ......P~
[020] EF 7B A5 ED 4D BD 1E 0A EE 9B 5A 7C 57 00 00 00 .{..M... ..Z|W...
[030] 00 .
rpc_check_hdr: rdata->data_size = 48
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0030
000a auth_len : 0000
000c call_id : 00000007
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000018
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 0 smbtrans read: 48
rpc_api_pipe: fragment first and last both set
000018 samr_io_r_open_domain
000018 smb_io_pol_hnd domain_pol
0018 data1: 00000000
001c data2: ef7e500a
0020 data3: a57b
0022 data4: 4ded
0024 data5: bd 1e 0a ee 9b 5a 7c 57
002c status: 00000000
samr_init_samr_q_create_user
000000 samr_io_q_create_user
000000 smb_io_pol_hnd domain_pol
0000 data1: 00000000
0004 data2: ef7e500a
0008 data3: a57b
000a data4: 4ded
000c data5: bd 1e 0a ee 9b 5a 7c 57
000014 smb_io_unihdr hdr_name
0014 uni_str_len: 0014
0016 uni_max_len: 0014
0018 buffer : 00000001
00001c smb_io_unistr2 uni_name
001c uni_max_len: 0000000a
0020 undoc : 00000000
0024 uni_str_len: 0000000a
0028 buffer : c.h.r.i.v.h.1.9.b.$.
003c acb_info : 00000080
0040 access_mask: e005000b
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x32 data_len: 0x5c
create_rpc_request: data_len: 5c auth_len: 0 alloc_hint: 4c
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 005c
000a auth_len : 0000
000c call_id : 00000008
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 0000004c
0014 context_id: 0000
0016 opnum : 0032
data_len: 5c data_calc_len: 5c
rpc_api_pipe: cmd:26 fnum:200b
size=174
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=92 (0x5C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=92 (0x5C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=92 (0x5C)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8203 (0x200B)
smb_bcc=107
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 5C 00 00 00 08 00 00 00 4C .......\ .......L
[020] 00 00 00 00 00 32 00 00 00 00 00 0A 50 7E EF 7B .....2.. ....P~.{
[030] A5 ED 4D BD 1E 0A EE 9B 5A 7C 57 14 00 14 00 01 ..M..... Z|W.....
[040] 00 00 00 0A 00 00 00 00 00 00 00 0A 00 00 00 63 ........ .......c
[050] 00 68 00 72 00 69 00 76 00 68 00 31 00 39 00 62 .h.r.i.v .h.1.9.b
[060] 00 24 00 80 00 00 00 0B 00 05 E0 .$...... ...
write_socket(4,178)
write_socket(4,178) wrote 178
got smb length of 112
size=112
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=56 (0x38)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=56 (0x38)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=57
[000] 5C 05 00 02 03 10 00 00 00 38 00 00 00 08 00 00 \....... .8......
[010] 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ...... ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 ........ .....0..
[030] 00 00 00 00 00 63 00 00 C0 .....c.. .
size=112
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=56 (0x38)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=56 (0x38)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=57
[000] 5C 05 00 02 03 10 00 00 00 38 00 00 00 08 00 00 \....... .8......
[010] 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 . ...... ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 ........ .....0..
[030] 00 00 00 00 00 63 00 00 C0 .....c.. .
rpc_check_hdr: rdata->data_size = 56
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0038
000a auth_len : 0000
000c call_id : 00000008
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000020
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 0 smbtrans read: 56
rpc_api_pipe: fragment first and last both set
000018 samr_io_r_create_user
000018 smb_io_pol_hnd user_pol
0018 data1: 00000000
001c data2: 00000000
0020 data3: 0000
0022 data4: 0000
0024 data5: 00 00 00 00 00 00 00 00
002c unknown_0: 00000030
0030 user_rid : 00000000
0034 status: c0000063
init_samr_q_close_hnd
000000 samr_io_q_close_hnd
000000 smb_io_pol_hnd pol
0000 data1: 00000000
0004 data2: 00000000
0008 data3: 0000
000a data4: 0000
000c data5: 00 00 00 00 00 00 00 00
rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....
create_rpc_request: opnum: 0x1 data_len: 0x2c
create_rpc_request: data_len: 2c auth_len: 0 alloc_hint: 1c
000000 smb_io_rpc_hdr hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 00
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 002c
000a auth_len : 0000
000c call_id : 00000009
000010 smb_io_rpc_hdr_req hdr_req
0010 alloc_hint: 0000001c
0014 context_id: 0000
0016 opnum : 0001
data_len: 2c data_calc_len: 2c
rpc_api_pipe: cmd:26 fnum:200b
size=126
smb_com=0x25
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=8
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=16
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=44 (0x2C)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=82 (0x52)
smb_vwv[11]=44 (0x2C)
smb_vwv[12]=82 (0x52)
smb_vwv[13]=2 (0x2)
smb_vwv[14]=38 (0x26)
smb_vwv[15]=8203 (0x200B)
smb_bcc=59
[000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\....
[010] 00 00 03 10 00 00 00 2C 00 00 00 09 00 00 00 1C ......., ........
[020] 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 ........ ........
[030] 00 00 00 00 00 00 00 00 00 00 00 ........ ...
write_socket(4,130)
write_socket(4,130) wrote 130
got smb length of 100
size=100
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
[000] 2C 05 00 02 03 10 00 00 00 30 00 00 00 09 00 00 ,....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ .....
size=100
smb_com=0x25
smb_rcls=1
smb_reh=0
smb_err=234
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=10
smb_vwv[0]=0 (0x0)
smb_vwv[1]=44 (0x2C)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=56 (0x38)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=44 (0x2C)
smb_vwv[7]=56 (0x38)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_bcc=45
[000] 2C 05 00 02 03 10 00 00 00 30 00 00 00 09 00 00 ,....... .0......
[010] 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[020] 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ .....
rpc_check_hdr: rdata->data_size = 44
000000 smb_io_rpc_hdr rpc_hdr
0000 major : 05
0001 minor : 00
0002 pkt_type : 02
0003 flags : 03
0004 pack_type0: 10
0005 pack_type1: 00
0006 pack_type2: 00
0007 pack_type3: 00
0008 frag_len : 0030
000a auth_len : 0000
000c call_id : 00000009
000010 smb_io_rpc_hdr_resp rpc_hdr_resp
0010 alloc_hint: 00000018
0014 context_id: 0000
0016 cancel_ct : 00
0017 reserved : 00
rpc_api_pipe: len left: 4 smbtrans read: 44
rpc_read: data_to_read: 4 rdata offset: 44 extra_data_size: 4
rpc_read: grew buffer by 4 bytes to 48
write_soUnable to join domain CCH.
cket(4,59)
write_socket(4,59) wrote 59
got smb length of 64
size=64
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=12
smb_vwv[0]=255 (0xFF)
smb_vwv[1]=0 (0x0)
smb_vwv[2]=0 (0x0)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=4 (0x4)
smb_vwv[6]=60 (0x3C)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_bcc=5
[000] 03 08 00 00 C0 .....
rpc_read: num_read = 4, read offset: 0, to read: 4
rpc_api_pipe: fragment first and last both set
000018 samr_io_r_close_hnd
000018 smb_io_pol_hnd pol
0018 data1: 00000000
001c data2: 00000000
0020 data3: 0000
0022 data4: 0000
0024 data5: 00 00 00 00 00 00 00 00
002c status: c0000008
error closing user policywrite_socket(4,45)
write_socket(4,45) wrote 45
got smb length of 35
size=35
smb_com=0x4
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=32769
smb_tid=6149
smb_pid=23279
smb_uid=10243
smb_mid=1
smt_wct=0
smb_bcc=0
