Impacket attrib.py
SMB 上のファイルやディレクトリの DOS／NTFS 属性を照会・変更します。
| 項目 | 内容 |
|---|---|
| 実装 | examples/attrib.py |
| カテゴリ | SMB / MSRPC / NTLM |
| 規模 | 341 行 |
| 配布 | setup.py の scripts=examples/*.py によりスクリプトとしてインストール |
CLI と入力
Section titled “CLI と入力”オプションの最新の定義は python examples/attrib.py -h で確認できます。
subcommand: ATTRIB_QUERY_ACTION、ATTRIB_SET_ACTION
| 引数 | 説明 |
|---|---|
target | [[domain/]username[:password]@] |
share | The share in which the desired file to query or modify resides. |
path | The path of the desired file whose attributes we wish to query or modify. |
-debug | Turn DEBUG output ON |
-hashes | NTLM hashes, format is LMHASH:NTHASH |
-no-pass | Don’t ask for password (useful for -k) |
-k | Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line |
-aesKey | AES key to use for Kerberos Authentication (128 or 256 bits) |
-p / --port | Destination port to connect to the SMB Server.（既定値: 445） |
-dc-ip | IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter |
-target-ip | IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it |
-t / --timeout | Set connection timeout (seconds).（既定値: 60） |
-r / --readonly | A file or directory that is read-only. For a file, applications can read the file but cannot write to it or delete it. For a directory, applications cannot delete it, but applications can create and delete files from that directory. |
-H / --hidden | A file or directory that is hidden. Files and directories marked with this attribute do not appear in an ordinary directory listing. |
-s / --system | A file or directory that the operating system uses a part of or uses exclusively. |
-a / --archive | A file or directory that requires to be archived. Applications use this attribute to mark files for backup or removal. |
-n / --normal | A file that does not have other attributes set. This flag is used to clear all other flags by specifying it with no other flags set. |
-t / --temporary | A file that is being used for temporary storage. The operating system can choose to store this file’s data in memory rather than on mass storage, writing the data to mass storage only if data remains in the file when the file is closed. |
-c / --compressed | A file or directory that is compressed. For a file, all of the data in the file is compressed. For a directory, compression is the default for newly created files and subdirectories. |
-o / --offline | The data in this file is not available immediately. This attribute indicates that the file data is physically moved to offline storage. This attribute is used by Remote Storage, which is hierarchical storage management software. |
-e / --encrypted | A file or directory that is encrypted. For a file, all data streams in the file are encrypted. For a directory, encryption is the default for newly created files and subdirectories. |
-p / --pinned | This attribute indicates user intent that the file or directory should be kept fully present locally even when not being actively accessed. This attribute is for use with hierarchical storage management software. |
-u / --unpinned | This attribute indicates that the file or directory should not be kept fully present locally except when being actively accessed. This attribute is for use with hierarchical storage management software. |
詳細な処理フロー
Section titled “詳細な処理フロー”target、share、path で SMB session/tree/file handle を開き、query は basic information を取得して flag を表示します。set は readonly/hidden/system/archive 等の +/-/= 指定を現在値へ適用し、SMB1/SMB2 に対応する set-info request を送ります。
仕組みの詳細
Section titled “仕組みの詳細”Windows file attribute は複数の bit flag で、file metadata の basic
information に含まれます。query は SMB tree connect と file open を行い、
SMB1 では TRANS2/query information、SMB2/3 では QUERY_INFO 相当から basic
information を得て FileAttributes.unpack() で表示用 flag へ展開します。
set は指定された +、-、= の意味を現在 mask に適用します。複数 flag を
更新しても一回の basic information write へまとめ、timestamp 等の同じ構造に
含まれる非対象 field は保持します。NORMAL は他 flag との組み合わせに制約が
あるため、単純な OR では正しい値にならない場合があります。
SMB1/SMB2 で open access mask、share mode、information class、structure layout
が異なります。読み取りだけなら FILE_READ_ATTRIBUTES、変更では
FILE_WRITE_ATTRIBUTES が必要です。directory path と file path の双方を
扱い、handle close は set/query の成否にかかわらず行います。
主要な実装要素
Section titled “主要な実装要素”| シンボル | 位置 | 責務を追う入口 |
|---|---|---|
FileAttributes | 76 | pack()、unpack()、repr_attribs() |
attrib_query() | 164 | モジュール関数 |
attrib_set() | 175 | モジュール関数 |
main() | 198 | モジュール関数 |
Impacket 内部
Section titled “Impacket 内部”| モジュール | 使用する主な名前 |
|---|---|
impacket.examples | logger |
impacket.examples.utils | parse_target |
impacket | smbconnection, version |
impacket.nmb | SMB_SESSION_PORT |
impacket.smb | FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, FILE_WRITE_ATTRIBUTES, SMBQueryFileBasicInfo, SMBSetFileBasicInfo, SMB_DIALECT, SMB_QUERY_FILE_BASIC_INFO, SMB_SET_FILE_BASIC_INFO |
impacket.smb3structs | FILE_BASIC_INFORMATION, SMB2_FILE_BASIC_INFO |
出力・副作用・必要権限
Section titled “出力・副作用・必要権限”- 対象の状態を変更する操作があります。変更前に対象名や SID、パスを確認してください。
失敗経路と後始末
Section titled “失敗経路と後始末”- 失敗時は、名前解決、接続、認証、サービスの状態、権限のどこで止まったかを、プロトコルのステータスから切り分けます。
実装を変更するとき
Section titled “実装を変更するとき”smbconnection、smb、smb3structs に依存します。FileAttributes.pack() / unpack() が CLI 表現と bitmask を変換し、attrib_query() / attrib_set() が protocol 差を吸収します。
- 構文:
python -m py_compile examples/attrib.py - CLI:
python examples/attrib.py -h - 関連テスト:
tests/SMB_RPC/test_nmb.py - 関連テスト:
tests/SMB_RPC/test_smb.py - 関連テスト:
tests/SMB_RPC/test_smbserver.py