Skip to content

Conversation

@gpotter2
Copy link
Member

@gpotter2 gpotter2 commented Feb 11, 2025

  • add client fragmentation
  • move DCE/RPC defragmentation after the decryption/integrity check
  • fix vt_trailer parsing when packet encryption is used
  • improve error logging when DCE/RPC fails to be parsed
  • fix request/response association when passively sniffing an encrypted pcap

(yeah.. currently we tried to reassemble encrypted chunks -_-)

@gpotter2 gpotter2 changed the title DCE/RPC: defragment should happen after integrity check/decryption DCE/RPC: various bug fixes in PKT_PRIVACY mode Feb 26, 2025
@codecov
Copy link

codecov bot commented Feb 26, 2025

Codecov Report

Attention: Patch coverage is 69.29825% with 35 lines in your changes missing coverage. Please review.

Project coverage is 82.11%. Comparing base (7275516) to head (b226b7c).
Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
scapy/layers/dcerpc.py 69.38% 30 Missing ⚠️
scapy/layers/smbclient.py 58.33% 5 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4664      +/-   ##
==========================================
+ Coverage   81.90%   82.11%   +0.21%     
==========================================
  Files         359      359              
  Lines       86574    86615      +41     
==========================================
+ Hits        70909    71126     +217     
+ Misses      15665    15489     -176     
Files with missing lines Coverage Δ
scapy/layers/msrpce/rpcclient.py 52.27% <100.00%> (+0.21%) ⬆️
scapy/layers/smb2.py 88.11% <100.00%> (+0.03%) ⬆️
scapy/layers/smbclient.py 73.96% <58.33%> (-0.16%) ⬇️
scapy/layers/dcerpc.py 90.57% <69.38%> (-0.86%) ⬇️

... and 24 files with indirect coverage changes

@gpotter2 gpotter2 changed the title DCE/RPC: various bug fixes in PKT_PRIVACY mode DCE/RPC: various bug fixes in PKT_PRIVACY mode / client fragmentation Feb 26, 2025
@gpotter2 gpotter2 merged commit d61ab7b into secdev:master Feb 26, 2025
23 of 24 checks passed
@gpotter2 gpotter2 deleted the dcerpc-frag branch February 26, 2025 22:46
@gpotter2 gpotter2 added this to the 2.7.0 milestone Nov 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant