1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
DCERPC binding strings
----------------------
When connecting to a dcerpc service you need to specify a binding
string.
The format is:
TRANSPORT:host[flags]
where TRANSPORT is either ncacn_np for SMB or ncacn_ip_tcp for RPC/TCP
"host" is an IP or hostname or netbios name. If the binding string
identifies the server side of an endpoint, "host" may be an empty
string.
"flags" can include a SMB pipe name if using the ncacn_np transport or
a TCP port number if using the ncacn_ip_tcp transport, otherwise they
will be auto-determined.
other recognised flags are:
sign : enable ntlmssp signing
seal : enable ntlmssp sealing
spnego : use SPNEGO instead of NTLMSSP authentication
krb5 : use KRB5 instead of NTLMSSP authentication
connect : enable rpc connect level auth (auth, but no sign or seal)
validate : enable the NDR validator
print : enable debugging of the packets
bigendian : use bigendian RPC
padcheck : check reply data for non-zero pad bytes
Here are some examples:
ncacn_np:myserver
ncacn_np:myserver[samr]
ncacn_np:myserver[\pipe\samr]
ncacn_np:myserver[/pipe/samr]
ncacn_np:myserver[samr,sign,print]
ncacn_np:myserver[sign,spnego]
ncacn_np:myserver[\pipe\samr,sign,seal,bigendian]
ncacn_np:myserver[/pipe/samr,seal,validate]
ncacn_np:
ncacn_np:[/pipe/samr]
ncacn_ip_tcp:myserver
ncacn_ip_tcp:myserver[1024]
ncacn_ip_tcp:myserver[sign,seal]
ncacn_ip_tcp:myserver[spnego,seal]
IDEA: Maybe extend UNC names like this?
smbclient //server/share
smbclient //server/share[sign,seal,spnego]
|
