<s> from impacket . dcerpc . v5 . ndr import NDRENUM , NDRSTRUCT , NDRUNION <EOL> from impacket . dcerpc . v5 . dcomrt import PMInterfacePointer , INTERFACE , DCOMCALL , DCOMANSWER , IRemUnknown2 <EOL> from impacket . dcerpc . v5 . dtypes import LONG , LONGLONG , ULONG , WSTR <EOL> from impacket . dcerpc . v5 . enum import Enum <EOL> from impacket . dcerpc . v5 . rpcrt import DCERPCException <EOL> from impacket import hresult_errors <EOL> from impacket . uuid import string_to_bin <EOL> class DCERPCSessionError ( DCERPCException ) : <EOL> def __init__ ( self , error_string = None , error_code = None , packet = None ) : <EOL> DCERPCException . __init__ ( self , error_string , error_code , packet ) <EOL> def __str__ ( self ) : <EOL> if hresult_errors . ERROR_MESSAGES . has_key ( self . error_code ) : <EOL> error_msg_short = hresult_errors . ERROR_MESSAGES [ self . error_code ] [ <NUM_LIT:0> ] <EOL> error_msg_verbose = hresult_errors . ERROR_MESSAGES [ self . error_code ] [ <NUM_LIT:1> ] <EOL> return '<STR_LIT>' % ( self . error_code , error_msg_short , error_msg_verbose ) <EOL> else : <EOL> return '<STR_LIT>' % self . error_code <EOL> CLSID_ShadowCopyProvider = string_to_bin ( '<STR_LIT>' ) <EOL> IID_IVssSnapshotMgmt = string_to_bin ( '<STR_LIT>' ) <EOL> IID_IVssEnumObject = string_to_bin ( '<STR_LIT>' ) <EOL> IID_IVssDifferentialSoftwareSnapshotMgmt = string_to_bin ( '<STR_LIT>' ) <EOL> IID_IVssEnumMgmtObject = string_to_bin ( '<STR_LIT>' ) <EOL> IID_ShadowCopyProvider = string_to_bin ( '<STR_LIT>' ) <EOL> class VSS_ID ( NDRSTRUCT ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , '<STR_LIT>' ) , <EOL> ) <EOL> def getAlignment ( self ) : <EOL> return <NUM_LIT:2> <EOL> VSS_PWSZ = WSTR <EOL> VSS_TIMESTAMP = LONGLONG <EOL> error_status_t = LONG <EOL> class VSS_OBJECT_TYPE ( NDRENUM ) : <EOL> class enumItems ( Enum ) : <EOL> VSS_OBJECT_UNKNOWN = <NUM_LIT:0> <EOL> VSS_OBJECT_NONE = <NUM_LIT:1> <EOL> VSS_OBJECT_SNAPSHOT_SET = <NUM_LIT:2> <EOL> VSS_OBJECT_SNAPSHOT = <NUM_LIT:3> <EOL> VSS_OBJECT_PROVIDER = <NUM_LIT:4> <EOL> VSS_OBJECT_TYPE_COUNT = <NUM_LIT:5> <EOL> class VSS_MGMT_OBJECT_TYPE ( NDRENUM ) : <EOL> class enumItems ( Enum ) : <EOL> VSS_MGMT_OBJECT_UNKNOWN = <NUM_LIT:0> <EOL> VSS_MGMT_OBJECT_VOLUME = <NUM_LIT:1> <EOL> VSS_MGMT_OBJECT_DIFF_VOLUME = <NUM_LIT:2> <EOL> VSS_MGMT_OBJECT_DIFF_AREA = <NUM_LIT:3> <EOL> class VSS_VOLUME_SNAPSHOT_ATTRIBUTES ( NDRENUM ) : <EOL> class enumItems ( Enum ) : <EOL> VSS_VOLSNAP_ATTR_PERSISTENT = <NUM_LIT> <EOL> VSS_VOLSNAP_ATTR_NO_AUTORECOVERY = <NUM_LIT> <EOL> VSS_VOLSNAP_ATTR_CLIENT_ACCESSIBLE = <NUM_LIT> <EOL> VSS_VOLSNAP_ATTR_NO_AUTO_RELEASE = <NUM_LIT> <EOL> VSS_VOLSNAP_ATTR_NO_WRITERS = <NUM_LIT> <EOL> class VSS_SNAPSHOT_STATE ( NDRENUM ) : <EOL> class enumItems ( Enum ) : <EOL> VSS_SS_UNKNOWN = <NUM_LIT> <EOL> VSS_SS_CREATED = <NUM_LIT> <EOL> class VSS_PROVIDER_TYPE ( NDRENUM ) : <EOL> class enumItems ( Enum ) : <EOL> VSS_PROV_UNKNOWN = <NUM_LIT:0> <EOL> class VSS_VOLUME_PROP ( NDRSTRUCT ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_PWSZ ) , <EOL> ( '<STR_LIT>' , VSS_PWSZ ) , <EOL> ) <EOL> class VSS_MGMT_OBJECT_UNION ( NDRUNION ) : <EOL> commonHdr = ( <EOL> ( '<STR_LIT>' , ULONG ) , <EOL> ) <EOL> union = { <EOL> VSS_MGMT_OBJECT_TYPE . VSS_MGMT_OBJECT_VOLUME : ( '<STR_LIT>' , VSS_VOLUME_PROP ) , <EOL> } <EOL> class VSS_MGMT_OBJECT_PROP ( NDRSTRUCT ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_MGMT_OBJECT_TYPE ) , <EOL> ( '<STR_LIT>' , VSS_MGMT_OBJECT_UNION ) , <EOL> ) <EOL> class IVssEnumMgmtObject_Next ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:3> <EOL> structure = ( <EOL> ( '<STR_LIT>' , ULONG ) , <EOL> ) <EOL> class IVssEnumMgmtObject_NextResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_MGMT_OBJECT_PROP ) , <EOL> ( '<STR_LIT>' , ULONG ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class IVssEnumObject_Next ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:3> <EOL> structure = ( <EOL> ( '<STR_LIT>' , ULONG ) , <EOL> ) <EOL> class IVssEnumObject_NextResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_MGMT_OBJECT_PROP ) , <EOL> ( '<STR_LIT>' , ULONG ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class GetProviderMgmtInterface ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:3> <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_ID ) , <EOL> ( '<STR_LIT>' , VSS_ID ) , <EOL> ) <EOL> class GetProviderMgmtInterfaceResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , PMInterfacePointer ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class QueryVolumesSupportedForSnapshots ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:4> <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_ID ) , <EOL> ( '<STR_LIT>' , LONG ) , <EOL> ) <EOL> class QueryVolumesSupportedForSnapshotsResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , PMInterfacePointer ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class QuerySnapshotsByVolume ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:5> <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_PWSZ ) , <EOL> ( '<STR_LIT>' , VSS_ID ) , <EOL> ) <EOL> class QuerySnapshotsByVolumeResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , PMInterfacePointer ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class QueryDiffAreasForVolume ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:6> <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_PWSZ ) , <EOL> ) <EOL> class QueryDiffAreasForVolumeResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , PMInterfacePointer ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> class QueryDiffAreasOnVolume ( DCOMCALL ) : <EOL> opnum = <NUM_LIT:7> <EOL> structure = ( <EOL> ( '<STR_LIT>' , VSS_PWSZ ) , <EOL> ) <EOL> class QueryDiffAreasOnVolumeResponse ( DCOMANSWER ) : <EOL> structure = ( <EOL> ( '<STR_LIT>' , PMInterfacePointer ) , <EOL> ( '<STR_LIT>' , error_status_t ) , <EOL> ) <EOL> OPNUMS = { <EOL> } <EOL> class IVssEnumMgmtObject ( IRemUnknown2 ) : <EOL> def __init__ ( self , interface ) : <EOL> IRemUnknown2 . __init__ ( self , interface ) <EOL> self . _iid = IID_IVssEnumMgmtObject <EOL> def Next ( self , celt ) : <EOL> request = IVssEnumMgmtObject_Next ( ) <EOL> request [ '<STR_LIT>' ] = self . get_cinstance ( ) . get_ORPCthis ( ) <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> request [ '<STR_LIT>' ] = celt <EOL> resp = self . request ( request , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return resp <EOL> class IVssEnumObject ( IRemUnknown2 ) : <EOL> def __init__ ( self , interface ) : <EOL> IRemUnknown2 . __init__ ( self , interface ) <EOL> self . _iid = IID_IVssEnumObject <EOL> def Next ( self , celt ) : <EOL> request = IVssEnumObject_Next ( ) <EOL> request [ '<STR_LIT>' ] = self . get_cinstance ( ) . get_ORPCthis ( ) <EOL> request [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> request [ '<STR_LIT>' ] = celt <EOL> dce = self . connect ( ) <EOL> resp = dce . request ( request , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return resp <EOL> class IVssSnapshotMgmt ( IRemUnknown2 ) : <EOL> def __init__ ( self , interface ) : <EOL> IRemUnknown2 . __init__ ( self , interface ) <EOL> self . _iid = IID_IVssSnapshotMgmt <EOL> def GetProviderMgmtInterface ( self , providerId = IID_ShadowCopyProvider , interfaceId = IID_IVssDifferentialSoftwareSnapshotMgmt ) : <EOL> req = GetProviderMgmtInterface ( ) <EOL> classInstance = self . get_cinstance ( ) <EOL> req [ '<STR_LIT>' ] = classInstance . get_ORPCthis ( ) <EOL> req [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> req [ '<STR_LIT>' ] = providerId <EOL> req [ '<STR_LIT>' ] = interfaceId <EOL> resp = self . request ( req , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return IVssDifferentialSoftwareSnapshotMgmt ( INTERFACE ( classInstance , '<STR_LIT>' . join ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) , self . get_ipidRemUnknown ( ) , target = self . get_target ( ) ) ) <EOL> def QueryVolumesSupportedForSnapshots ( self , providerId , iContext ) : <EOL> req = QueryVolumesSupportedForSnapshots ( ) <EOL> classInstance = self . get_cinstance ( ) <EOL> req [ '<STR_LIT>' ] = classInstance . get_ORPCthis ( ) <EOL> req [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> req [ '<STR_LIT>' ] = providerId <EOL> req [ '<STR_LIT>' ] = iContext <EOL> resp = self . request ( req , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return IVssEnumMgmtObject ( INTERFACE ( self . get_cinstance ( ) , '<STR_LIT>' . join ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) , self . get_ipidRemUnknown ( ) , target = self . get_target ( ) ) ) <EOL> def QuerySnapshotsByVolume ( self , volumeName , providerId = IID_ShadowCopyProvider ) : <EOL> req = QuerySnapshotsByVolume ( ) <EOL> classInstance = self . get_cinstance ( ) <EOL> req [ '<STR_LIT>' ] = classInstance . get_ORPCthis ( ) <EOL> req [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> req [ '<STR_LIT>' ] = volumeName <EOL> req [ '<STR_LIT>' ] = providerId <EOL> try : <EOL> resp = self . request ( req , self . _iid , uuid = self . get_iPid ( ) ) <EOL> except DCERPCException , e : <EOL> print e <EOL> from impacket . winregistry import hexdump <EOL> data = e . get_packet ( ) <EOL> hexdump ( data ) <EOL> kk = QuerySnapshotsByVolumeResponse ( data ) <EOL> kk . dump ( ) <EOL> return IVssEnumObject ( INTERFACE ( self . get_cinstance ( ) , '<STR_LIT>' . join ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) , self . get_ipidRemUnknown ( ) , target = self . get_target ( ) ) ) <EOL> class IVssDifferentialSoftwareSnapshotMgmt ( IRemUnknown2 ) : <EOL> def __init__ ( self , interface ) : <EOL> IRemUnknown2 . __init__ ( self , interface ) <EOL> self . _iid = IID_IVssDifferentialSoftwareSnapshotMgmt <EOL> def QueryDiffAreasOnVolume ( self , pwszVolumeName ) : <EOL> req = QueryDiffAreasOnVolume ( ) <EOL> classInstance = self . get_cinstance ( ) <EOL> req [ '<STR_LIT>' ] = classInstance . get_ORPCthis ( ) <EOL> req [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> req [ '<STR_LIT>' ] = pwszVolumeName <EOL> resp = self . request ( req , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return IVssEnumMgmtObject ( INTERFACE ( self . get_cinstance ( ) , '<STR_LIT>' . join ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) , self . get_ipidRemUnknown ( ) , target = self . get_target ( ) ) ) <EOL> def QueryDiffAreasForVolume ( self , pwszVolumeName ) : <EOL> req = QueryDiffAreasForVolume ( ) <EOL> classInstance = self . get_cinstance ( ) <EOL> req [ '<STR_LIT>' ] = classInstance . get_ORPCthis ( ) <EOL> req [ '<STR_LIT>' ] [ '<STR_LIT>' ] = <NUM_LIT:0> <EOL> req [ '<STR_LIT>' ] = pwszVolumeName <EOL> resp = self . request ( req , self . _iid , uuid = self . get_iPid ( ) ) <EOL> return IVssEnumMgmtObject ( INTERFACE ( self . get_cinstance ( ) , '<STR_LIT>' . join ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) , self . get_ipidRemUnknown ( ) , target = self . get_target ( ) ) ) </s>
