Clarke Morledge
2003-Oct-17 14:53 UTC
[Samba] rpcclient-style call for windows messenger service ("WinPopup")?
Can Samba be used to generated WinPopUp RPC calls on TCP port 135? I am familiar with using the "smbclient -M" command to send messages using the Win Popup protocol, otherwise known as Windows Messenger Service, or what a Microsoft user does from a DOS prompt as a "net send" command. WinPopup can be generated either via Microsoft file sharing protocols, using the "smbclient -M" method in Samba, or it can be generated with a Microsoft RPC call (through TCP port 135). In Samba, I would think that this can be done with rpcclient. However, I have not been able to figure out how to do it. Can anyone tell me how to construct an rpcclient request that mimics the "net send" command using Microsoft's RPC? From packet traces, the "net send" command issues RPC calls across the network to TCP port 135. I am working on a UNIX based script that will detect when a Microsoft OS has some virus/worm then and using Windows Messenger Service via Samba to notify the user that the system has been compromised. Unfortunately, the "smbclient -M" method requires that the recipient have Microsoft file sharing enabled (via ports 139, 445, and/or others) -- and that is not always the case. However, unless the user has disabled Messenger Service and/or RPC, I would think that using rpcclient to generate a message via the RPC service on TCP port 135 should work (I just don't know how to do that). Thanks. Clarke Morledge College of William and Mary Information Technology - Network Engineering Jones Hall (Room 18) Williamsburg VA 23187