"""Probe NmxSvc.NmxService through raw DCOM without the AVEVA x86 proxy. Credentials are read from MX_RPC_USER, MX_RPC_PASSWORD, and MX_RPC_DOMAIN. Do not put passwords in this file or in checked-in probe output. """ from __future__ import annotations import os import traceback from impacket.dcerpc.v5 import dcomrt, rpcrt from impacket.dcerpc.v5.dtypes import ULONG from impacket.uuid import string_to_bin, uuidtup_to_bin CLSID_NMX_SERVICE = string_to_bin("AE24BD51-2E80-44CC-905B-E5446C942BEB") IID_INMXSERVICE2 = string_to_bin("2630A513-A974-4B1A-8025-457A9A7C56B8") IID_INMXSERVICE2_BIND = uuidtup_to_bin(("2630A513-A974-4B1A-8025-457A9A7C56B8", "0.0")) class GetPartnerVersion(dcomrt.DCOMCALL): opnum = 11 structure = ( ("lPartnerGalaxyId", ULONG), ("lPartnerPlatformId", ULONG), ("lPartnerEngineId", ULONG), ) class GetPartnerVersionResponse(dcomrt.DCOMANSWER): structure = ( ("plPartnerVersion", ULONG), ("ErrorCode", dcomrt.error_status_t), ) def main() -> int: target = os.getenv("MX_RPC_TARGET", os.environ.get("COMPUTERNAME", "127.0.0.1")) user = os.getenv("MX_RPC_USER", "") password = os.getenv("MX_RPC_PASSWORD", "") domain = os.getenv("MX_RPC_DOMAIN", "") dcom = None try: dcom = dcomrt.DCOMConnection( target, username=user, password=password, domain=domain, authLevel=rpcrt.RPC_C_AUTHN_LEVEL_PKT_PRIVACY, ) iface = dcom.CoCreateInstanceEx(CLSID_NMX_SERVICE, IID_INMXSERVICE2) print("cocreate_ok") print("target=" + iface.get_target()) print("oxid=0x%016x" % iface.get_oxid()) print("oid=0x%016x" % iface.get_oid()) print("ipid=" + iface.get_iPid().hex()) print("ipidRemUnknown=" + iface.get_ipidRemUnknown().hex()) print("bindings=" + "|".join(binding["aNetworkAddr"].rstrip("\x00") for binding in iface.get_cinstance().get_string_bindings())) request = GetPartnerVersion() request["lPartnerGalaxyId"] = int(os.getenv("MX_PARTNER_GALAXY", "1"), 0) request["lPartnerPlatformId"] = int(os.getenv("MX_PARTNER_PLATFORM", "1"), 0) request["lPartnerEngineId"] = int(os.getenv("MX_PARTNER_ENGINE", "0x7ffd"), 0) response = iface.request(request, IID_INMXSERVICE2_BIND, iface.get_iPid()) print("get_partner_version_ok") print("partner_version=%d" % response["plPartnerVersion"]) print("error_code=0x%08x" % response["ErrorCode"]) return 0 except Exception as exc: # noqa: BLE001 - probe should print exact failure class. print("probe_error=%s: %s" % (type(exc).__name__, exc)) traceback.print_exc() return 1 finally: if dcom is not None: dcom.disconnect() if __name__ == "__main__": raise SystemExit(main())