Pass 5: DCE/RPC and DCOM realism

Make the DCE/RPC bind, DCOM activation, and DCOM ref counting look
like a real Windows client.

- rpcrt bind: emit a second context item carrying the [MS-RPCE]
  BindTimeFeatureNegotiation abstract syntax (UUID
  6cb71c2c-9812-4540-0300-000000000000) alongside the interface ctx.
  Track the main context index so transfer-syntax negotiation still
  picks the right one. The bind-ack validation now tolerates a
  negotiate_ack (Result=3) on the BTFN context and tolerates
  rejections of subordinate contexts in general.
- dcomrt RemAddRef / RemRelease: bump cPublicRefs from 1 to 5 to match
  ole32's reference batching, removing the single-ref-per-call tell.
- dcomrt RemoteCreateInstance ScmRequestInfo: set ClientImpLevel to 2
  (RPC_C_IMP_LEVEL_IDENTIFY) instead of leaving it at the default 0
  that Impacket previously emitted.
- DCOMConnection.CoCreateInstanceEx: issue an IObjectExporter
  ServerAlive2 preflight against the resolver before invoking the
  activator, mirroring Windows. Failures are logged and tolerated.

Author: aconite33

impacket/dcerpc/v5/dcomrt.py

@@ -1107,6 +1107,15 @@ def initConnection(self):
         DCOMConnection.PORTMAPS[self.__target] = self.__portmap
 
     def CoCreateInstanceEx(self, clsid, iid):
+        # Real Windows clients always issue an IObjectExporter::ServerAlive2
+        # preflight against the resolver before invoking the activator.
+        # Skipping it is one of the more obvious DCOM/WMI fingerprints, so
+        # we mirror Windows here. Failures are tolerated; activation will
+        # surface its own errors.
+        try:
+            IObjectExporter(self.__portmap).ServerAlive2()
+        except Exception as e:
+            LOG.debug('ServerAlive2 preflight failed (continuing): %s' % e)
         scm = IRemoteSCMActivator(self.__portmap)
         iInterface = scm.RemoteCreateInstance(clsid, iid)
         self.initTimer()
@@ -1418,7 +1427,10 @@ def RemAddRef(self):
         request['cInterfaceRefs'] = 1
         element = REMINTERFACEREF()
         element['ipid'] = self.get_iPid()
-        element['cPublicRefs'] = 1
+        # Windows COM runtime adds references in larger increments to avoid
+        # round-tripping per ref. 5 matches the reference batch size used by
+        # ole32.dll on current Windows builds.
+        element['cPublicRefs'] = 5
         request['InterfaceRefs'].append(element)
         resp = self.request(request, IID_IRemUnknown, self.get_ipidRemUnknown())
         return resp
@@ -1430,7 +1442,8 @@ def RemRelease(self):
         request['cInterfaceRefs'] = 1
         element = REMINTERFACEREF()
         element['ipid'] = self.get_iPid()
-        element['cPublicRefs'] = 1
+        # Match the AddRef batch so the server's refcount lands at 0.
+        element['cPublicRefs'] = 5
         request['InterfaceRefs'].append(element)
         resp = self.request(request, IID_IRemUnknown, self.get_ipidRemUnknown())
         DCOMConnection.delOid(self.get_target(), self.get_oid())
@@ -1705,7 +1718,9 @@ def RemoteGetClassObject(self, clsId, iid):
         # ScmRequestInfo
         scmInfo = ScmRequestInfoData()
         scmInfo['pdwReserved'] = NULL
-        #scmInfo['remoteRequest']['ClientImpLevel'] = 2
+        # 2 == RPC_C_IMP_LEVEL_IDENTIFY. Real Windows clients always populate
+        # this; leaving it at 0 is an Impacket-specific tell.
+        scmInfo['remoteRequest']['ClientImpLevel'] = 2
         scmInfo['remoteRequest']['cRequestedProtseqs'] = 1
         scmInfo['remoteRequest']['pRequestedProtseqs'].append(7)
 
@@ -1868,7 +1883,9 @@ def RemoteCreateInstance(self, clsId, iid):
         # ScmRequestInfo
         scmInfo = ScmRequestInfoData()
         scmInfo['pdwReserved'] = NULL
-        #scmInfo['remoteRequest']['ClientImpLevel'] = 2
+        # 2 == RPC_C_IMP_LEVEL_IDENTIFY. Real Windows clients always populate
+        # this; leaving it at 0 is an Impacket-specific tell.
+        scmInfo['remoteRequest']['ClientImpLevel'] = 2
         scmInfo['remoteRequest']['cRequestedProtseqs'] = 1
         scmInfo['remoteRequest']['pRequestedProtseqs'].append(7)
 

impacket/dcerpc/v5/rpcrt.py

@@ -139,9 +139,15 @@
 rpc_cont_def_result = {
     0       : 'acceptance',
     1       : 'user_rejection',
-    2       : 'provider_rejection'
+    2       : 'provider_rejection',
+    3       : 'negotiate_ack',
 }
 
+# [MS-RPCE] 3.3.1.5.3 BindTimeFeatureNegotiation. The abstract syntax UUID
+# encodes a feature bitmask in its low bytes. 0x03 = SecurityContextMultiplexing
+# | KeepConnectionOnOrphan, which is what current Windows clients advertise.
+BIND_TIME_FEATURE_NEGOTIATION_UUID = uuidtup_to_bin(('6cb71c2c-9812-4540-0300-000000000000', '1.0'))
+
 #status codes, references:
 #https://docs.microsoft.com/windows/desktop/Rpc/rpc-return-values
 #https://msdn.microsoft.com/library/default.asp?url=/library/en-us/randz/protocol/common_return_values.asp
@@ -1549,6 +1555,17 @@ def bind(self, iface_uuid, alter = 0, bogus_binds = 0, transfer_syntax = ('8a885
         item['ContextID'] = ctx
         item['TransItems'] = 1
         bind.addCtxItem(item)
+        self._bind_main_ctx = ctx
+
+        # Bind Time Feature Negotiation. Windows always sends a second
+        # context item advertising BTFN; servers that don't understand it
+        # respond with negotiate_ack rather than rejecting the bind.
+        btfn_item = CtxItem()
+        btfn_item['AbstractSyntax'] = BIND_TIME_FEATURE_NEGOTIATION_UUID
+        btfn_item['TransferSyntax'] = uuidtup_to_bin(transfer_syntax)
+        btfn_item['ContextID'] = ctx + 1
+        btfn_item['TransItems'] = 1
+        bind.addCtxItem(btfn_item)
 
         packet = MSRPCHeader()
         packet['type'] = MSRPC_BIND
@@ -1618,10 +1635,20 @@ def bind(self, iface_uuid, alter = 0, bogus_binds = 0, transfer_syntax = ('8a885
         else:
             raise DCERPCException('Unknown DCE RPC packet type received: %d' % resp['type'])
 
+        # The 1-based ContextID of the interface we actually care about.
+        main_ctx_index = getattr(self, '_bind_main_ctx', bogus_binds) + 1
         # check ack results for each context, except for the bogus ones
         for ctx in range(bogus_binds+1,bindResp['ctx_num']+1):
             ctxItems = bindResp.getCtxItem(ctx)
+            # Result 3 = negotiate_ack, sent by servers acknowledging a
+            # Bind Time Feature Negotiation context. Don't treat as fatal.
+            if ctxItems['Result'] == 3:
+                continue
             if ctxItems['Result'] != 0:
+                if ctx != main_ctx_index:
+                    # Subordinate contexts (e.g. extra transfer syntaxes)
+                    # may legitimately be rejected by the server.
+                    continue
                 msg = "Bind context %d rejected: " % ctx
                 msg += rpc_cont_def_result.get(ctxItems['Result'], 'Unknown DCE RPC context result code: %.4x' % ctxItems['Result'])
                 msg += "; "
@@ -1632,7 +1659,8 @@ def bind(self, iface_uuid, alter = 0, bogus_binds = 0, transfer_syntax = ('8a885
                 raise DCERPCException(msg)
 
             # Save the transfer syntax for later use
-            self.transfer_syntax = ctxItems['TransferSyntax'] 
+            if ctx == main_ctx_index:
+                self.transfer_syntax = ctxItems['TransferSyntax']
 
         # The received transmit size becomes the client's receive size, and the received receive size becomes the client's transmit size.
         self.__max_xmit_size = bindResp['max_rfrag']