-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
DCE/RPC: Add DCOM support #4815
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR adds comprehensive DCOM (Distributed Component Object Model) support to Scapy's DCE/RPC implementation. The main purpose is to enable Scapy to handle COM object instantiation, interface management, and remote method calls over DCE/RPC.
Key changes include:
- Implementation of a new
DCOM_Clientclass with full object lifecycle management capabilities - Enhanced DCE/RPC client with improved binding contexts, error handling, and security verification
- Extension of NDR field types and recursive field handling for complex DCOM structures
Reviewed Changes
Copilot reviewed 15 out of 15 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| scapy/packet.py | Error message fix for field building operation |
| scapy/layers/smb2.py | Addition of new SMB2 status codes for DCOM compatibility |
| scapy/layers/ntlm.py | Removal of duplicate error handling code |
| scapy/layers/msrpce/rpcserver.py | Import reorganization and typing improvements |
| scapy/layers/msrpce/rpcclient.py | Major enhancements to DCE/RPC client with security verification |
| scapy/layers/msrpce/raw/ms_dcom.py | Complete DCOM interface definitions and packet structures |
| scapy/layers/msrpce/mseerr.py | Error handling fix for extended error information |
| scapy/layers/msrpce/msdcom.py | New comprehensive DCOM client implementation |
| scapy/layers/msrpce/ept.py | Protocol identifier enum consolidation |
| scapy/layers/dcerpc.py | Core DCE/RPC improvements including COM interface support |
| scapy/fields.py | UTF-16 string length calculation fix |
| scapy/config.py | Addition of NDR64 configuration option |
| doc/scapy/layers/dcom.rst | New documentation for DCOM functionality |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #4815 +/- ##
==========================================
- Coverage 80.99% 80.21% -0.78%
==========================================
Files 365 348 -17
Lines 89112 89348 +236
==========================================
- Hits 72173 71672 -501
- Misses 16939 17676 +737
🚀 New features to boost your workflow:
|
DCOM_Clientclass that can instanciate classes, request interfaces, release them, call methods, etc.DCE/RPCclient, most notably improvements to the the handling of bindings contexts and better handling of errors in requestsDCERPC_Client