
    bp                     "   d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZ d d	lmZ d d
lmZmZ d dlZd dlZd dlm Z  d Z!d Z"ej#        ej$        ej%        ej&        ej'        ej(        ej)        ej*        ej+        ej,        ej-        ej.        ej/        ej0        ej1        ej2        ej3        ej4        ej5        ej6        ej7        ej8        ej9        ej:        ej;        ej<        ej=        gZ>d Z?d Z@d ZAe@ZBe@ZCe@ZDe@ZEe@ZFe@ZGe@ZHe@ZId ZJd ZKd ZLe@ZMd ZNd  eOe          D             ZPd ZQd ZRd ZSe@ZTe@ZUe@ZVe@ZWd ZXe@ZYd ZZe@Z[d Z\d Z]e@Z^e@Z_e@Z`e@Zae@Zbe@Zce@Zde@Zee@Zfe@Zge@Zhe@Zie@Zje@Zkd Zld Zmd Zne@Zoe@Zpe@Zqe@Zrd  Zsd! Ztd" Zue@Zve@Zwe@Zxe@Zye@Zze@Z{e@Z|e@Z}d# Z~d$ Ze@Zd% Zd& Zd' Zd( Zd) Zd* Zd+ Zd, Zd- Zd. Zd/ Zd0d1gZd2 Ze@Zd3 Zd4 Zd5 Zd6 Zd7 Zd8 Zd9 Zd: Ze@Zd; Ze@Ze@Zd< Zd= Ze@Zd> Zd? ZdS )@    N)Net)securitydrsuapinbtlsanetlogonntlmssp)netr_WorkstationInformation)dom_sid)Node)ndr_pack)CLI_CRED_NTLMv2_AUTHMUST_USE_KERBEROSDONT_USE_KERBEROS)NTSTATUSError)NT_STATUS_OBJECT_NAME_NOT_FOUNDNT_STATUS_NO_SUCH_DOMAIN)
SCOPE_BASEc                 4    t          j        |           j        S )N)ctypesc_uint32value)vs    ?/usr/lib/python3/dist-packages/samba/emulate/traffic_packets.pyuint32r   *   s    ?1##    c                 R    | dS t          | j        d                   }||k    rdS dS )NFr   T)r   args)runtimevalerr32s      r   check_runtime_errorr"   .   s2    u7<?##E||t5r   c                 *    t          d| z             d S )Nz[37;41;1mWarning: %s[00m)print)messages    r   warningr&   X   s    	
2g
>?????r   c                     dS NF packetconversationcontexts      r   null_packetr.      s    5r   c                     t          |j        |j                  }|                    |j                            d          t
          j        t
          j        z  t
          j        z             dS )N)credslprealm)domainflagsT)	r   r0   r1   finddcgetr   NBT_SERVER_LDAPNBT_SERVER_DSNBT_SERVER_WRITABLE)r+   r,   r-   nets       r   packet_cldap_3r;      sf    
GMgj
1
1
1CJJgjnnW--)'(-.  0 0 0 4r   c                 h    |j                                         t          k    rt          d           dS )NzQKerberos disabled but have dcerpc Alter_context_resp indicating Kerberos was usedF)
user_credsget_kerberos_stater   r&   r*   s      r   packet_dcerpc_15r?      s;     ,,..2CCC / 	0 	0 	05r   c                 h    |j                                         t          k    rt          d           dS )NzBKerberos enabled but have dcerpc AUTH3 indicating NTLMSSP was usedF)r=   r>   r   r&   r*   s      r   packet_dcerpc_16rA      s;     ,,..2CCC . 	/ 	/ 	/5r   c                 t    |                                 \  }}t          j                            ||           dS NT)guess_a_dns_lookupdnsresolverquery)r+   r,   r-   namertypes        r   packet_dns_0rJ      s4    ,,..KD%LtU###4r   c                 0    |                     d           dS rC   )get_drsuapi_connection_pairr*   s      r   packet_drsuapi_0rM      s    ''---4r   c                 @    g | ]}d |v t          t          |          S )NAME_FORMAT)getattrr   ).0_xs     r   
<listcomp>rS      s6     ( ( ( B&& $$&&&r   c                 l   |                                 \  }}t          j                    }|j        |_        t          j                    }d|_        d|_        t          j	        t                    |_        d|_        d|_        d|_        d|_        |g|_        |                    |d|          \  }}dS )Nr      i  i	     T)rL   r   DsNameStringserverstrDsNameRequest1format_flagsformat_offeredrandomchoicename_formatsformat_desiredcodepagelanguagecountnamesDsCrackNames)	r+   r,   r-   drshandlerd   reqresultctrs	            r   packet_drsuapi_12rk      s    5577KC ""EEI

 
"
"CCC|44CCLCLCCICI$$VQ44MVS4r   c                 X   t          j                    }t           j        |_        d|_        |j        |_        d|_        t          j                    }d	                    |j
                  |_        |g|_        |                                \  }}|                    |d|          \  }}dS )Nr   rV   zfoo/{}T)r   DsWriteAccountSpnRequest1 DRSUAPI_DS_SPN_OPERATION_REPLACE	operationunknown1user_dn	object_dnrc   rW   formatusernamerY   	spn_namesrL   DsWriteAccountSpn)	r+   r,   r-   rh   spn_namerf   rg   levelress	            r   packet_drsuapi_13rz      s    

+
-
-C<CMCLOCMCI#%%H??7#344HLJCM7799MS&((C88LUC4r   c                 n    |                                 \  }}|                    |           |j        d= dS )NT)rL   DsUnbinddrsuapi_connections)r+   r,   r-   rf   rg   s        r   packet_drsuapi_1r      s9    7799MS&LL#B'4r   c                 <   |j                             t                     |j                            t                     |j                            t                     |j                            t                     |j                            t                     dS r(   )r=   set_kerberos_stater   user_creds_badmachine_credsmachine_creds_badr0   r*   s      r   packet_kerberos_r     s     ))*;<<<--.?@@@,,->???001BCCCM$$%67775r   c                     | j         d         dk    r|                    dd           n|                    dd           dS )N   simpleT)newr   F)extraget_ldap_connectionr*   s      r   packet_ldap_0r   0  sO    |A(""##T#:::: 	##U#;;;4r   c                     |j         dd = dS )Nr|   F)ldap_connectionsr*   s      r   packet_ldap_2r   @  s     	 %5r   c                 R   | j         \  }}}}}}}	|st          }|                                }
|                    |          }||dk    r"|t          k    r|                    |||          }|
                    ||t          |          |                    d          dg           dS )N ,zpaged_results:1:1000)
expressionscopeattrscontrolsT)r   r   r   get_matching_dnguess_search_filtersearchintsplit)r+   r,   r-   r   dn_sigfilterr   r   descoidsamdbdns               r   packet_ldap_3r   G  s     8>|4UFFE5$ ''))E		 	 	(	(B 	&B,,EZ,?,?,,UFB??	LL"5zz{{3''12	  4 4 4
 4r   c                 Z   |                                 }t          j                    }|                    d|t          j                  }t          j                    }t          j        d          t          j        d          g}t          j        }d}	|	                    |||||	           dS )Nr   This OrganizationDigest Authenticationr   T)
 get_lsarpc_named_pipe_connectionr   ObjectAttributeOpenPolicy2r   SEC_FLAG_MAXIMUM_ALLOWEDTransSidArrayStringLSA_LOOKUP_NAMES_ALLLookupNames)
r+   r,   r-   c
objectAttr
pol_handlesidsrd   rx   rc   s
             r   packet_lsarpc_14r     s    0022A$&&JsJ'@B BJ DZ+,,Z/002E$EEMM*eT5%8884r   c                    |                                 }t          j                    }|                    d|t          j                  }t          j                    }t          j                    }t          d          }||_	        |g|_
        d|_        t          j                    }	t          j        }
d}|                    |||	|
|           dS )Nr   S-1-5-7rV   r   T)r   r   r   r   r   r   SidArraySidPtrr   sidr   num_sidsTransNameArrayr   
LookupSids)r+   r,   r-   r   r   r   r   r   xrd   rx   rc   s               r   packet_lsarpc_15r     s    0022A$&&JsJ'@B BJ <>>D
*,,C	ACGDIDM  E$EELLT5%7774r   c                    |                                 }t          j                    }|                    d|t          j                  }t	          j        |j                  }d}	 |                    |||           nB# t          $ r5}t          |t                    st          |t                    s Y d }~nd }~ww xY wdS )Nr   rV   T)r   r   r   r   r   r   r   
domain_sidQueryTrustedDomainInfoBySidr   r"   r   r   )	r+   r,   r-   r   r   r   domsidrx   errors	            r   packet_lsarpc_39r     s     	0022A$&&JsJ'@B BJ g011FE	%%j&%@@@@    #5*IJJ 	+E3KLL	 4s   %A= =
B<+B77B<c                 j   |                                 }t          j                    }t          j                    }t	          d          }||_        |g|_        d|_        t          j                    }t          j	        }d}	t          j
        }
t          j        }|                    ||||	|
|           dS )Nr   rV   r   T)get_lsarpc_connectionr   r   r   r   r   r   r   TransNameArray2r   'LSA_LOOKUP_OPTION_SEARCH_ISOLATED_NAMESLSA_CLIENT_REVISION_2LookupSids3)r+   r,   r-   r   r   r   r   rd   rx   rc   lookup_optionsclient_revisions               r   packet_lsarpc_76r     s    %%''A<>>D
*,,C	ACGDIDM!!E$EE@N/OMM$ue^_MMM4r   c                 $   |                                 }t          j                    }t          j        d          t          j        d          g}t          j        }d}t          j        }t          j        }	|                    ||||||	           dS )Nr   r   r   T)r   r   TransSidArray3r   r   r   r   LookupNames4)
r+   r,   r-   r   r   rd   rx   rc   r   r   s
             r   packet_lsarpc_77r     s    %%''A  DZ+,,Z/002E$EE@N/ONN5$unoNNN4r   c                 p    t                      }	 |                    d|j        dd           n#  Y nxY wdS )NANAME   F)timeout	broadcastT)r   
query_namerX   )r+   r,   r-   ns       r   packet_nbns_0r     sB    A	Wgna5IIII4s   / 3c                     |                                 }|                                \  }}t                      }|                    |j        |j        ||d|           dS )N   T)get_netlogon_connectionget_authenticatorr
   netr_LogonGetDomainInforX   netbios_name)r+   r,   r-   r   authsuccrG   s          r   packet_rpc_netlogon_29r   #  sh    ''))A,,..LT4'))Egn%2""#% % % 4r   c                 L   |                                 }|                                \  }}d}|j                                                            d          }t          |          }d t          j        ||z
            D             }	t          j	                    }
||
_
        |	d |D             z   |
_        |j                            |
           |                    |j        |j                                        |j                                        |j        ||
           dS )Ni   z	utf-16-lec                 Z    g | ](}t          |t                    r|nt          |          )S r)   
isinstancer   ordrQ   r   s     r   rS   z*packet_rpc_netlogon_30.<locals>.<listcomp><  s1    [[[qJq#&&2qqCFF[[[r   c                 Z    g | ](}t          |t                    r|nt          |          )S r)   r   r   s     r   rS   z*packet_rpc_netlogon_30.<locals>.<listcomp>?  s1    NNNjC00<c!ffNNNr   T)r   r   r   get_passwordencodelenosurandomr   netr_CryptPasswordlengthdataencrypt_netr_crypt_passwordnetr_ServerPasswordSet2rX   get_usernameget_secure_channel_typer   )r+   r,   r-   r   r   r   DATA_LENnewpasspwd_lenfillerpwds              r   packet_rpc_netlogon_30r   2  s   ''))A,,..LT4H #002299+FFG'llG[[BJxRYGY<Z<Z[[[F

%
'
'CCJNNgNNNNCH55c:::gn &3@@BB%3KKMM%2"!# # # 4r   c                 j    fd}                     |j        j        j                  _        dS )Nc                                                     }|                                 }|                     t                     t	          j        j        |           }t          j        }t          j	        }d}|
                    j        j                                        ||||           |                     |           d S Nr   )r   r>   r   r   samlogon_logon_infor3   r   r   $NetlogonNetworkTransitiveInformationNetlogonValidationSamInfo4netr_LogonSamLogonExrX   r   get_workstation)r0   r   	old_statelogonlogon_levelvalidation_level
netr_flagsr-   s          r   connectz'packet_rpc_netlogon_39.<locals>.connectQ  s    ++-- ,,..	  !2333#GN$+$8$)+ + C#>
	w~&4DDFF*$/)	+ 	+ 	+ 	  +++++r   Twith_random_bad_credentialsr=   r   last_samlogon_badr+   r,   r-   r  s     ` r   packet_rpc_netlogon_39r  O  sV    , , , , ,. 	++G,3,>,3,B,3,E	G 	G 
 4r   c                 \   t          j                    }d|_        t          j                    }t           j        |_        ||_        t          j                    }t           j        |_        | |_        t          j                    }t           j        |_        |||g|_	        t          |          S )N   )r	   AV_PAIR_LISTrc   AV_PAIRMsvAvNbComputerNameAvIdValueMsvAvNbDomainNameMsvAvEOLpairr   )domain_namecomputer_nametarget_infocomputername
domainnameeols         r   samlogon_targetr  o  s    &((KK?$$L3L&L""J/JO"J
/

CCH"L#6KK   r   c                 :   t          | |          }d}|                    t          ||          }t          j                    }d |D             |_        t          j                    |_        t          |d                   |j        _	        d |d         D             |j        _
        t          j                    |_        |                                \  }}||j        j        _        ||j        j        _        |                                |j        j        _        |S )Ns   abcdefgh)r4   	challenger  c                 Z    g | ](}t          |t                    r|nt          |          )S r)   r   r   s     r   rS   z'samlogon_logon_info.<locals>.<listcomp>  s1    RRR1
1c 2 2>11ARRRr   nt_responsec                 Z    g | ](}t          |t                    r|nt          |          )S r)   r   r   s     r   rS   z'samlogon_logon_info.<locals>.<listcomp>  s1    ```1
1c 2 2>11A```r   )r  get_ntlm_responser   r   netr_NetworkInfor  netr_ChallengeResponsentr   r   r   netr_IdentityInfoidentity_infoget_ntlm_username_domainr  stringaccount_namer  workstation)	r  r  r0   target_info_blobr  responser  rt   r3   s	            r   r   r     s   &{MBBI&&-A1:3C ' E EH %''ERR	RRREO"9;;EHh}566EHO``Q^H_```EHM"466E88::Xv.4E#*.6E$+.3.C.C.E.EE#*Lr   c                     |                                 }|                    |j        t          j        t          j        z  t          j        z             dS rC   )r   netr_DsrEnumerateDomainTrustsrX   r   NETR_TRUST_FLAG_IN_FORESTNETR_TRUST_FLAG_OUTBOUNDNETR_TRUST_FLAG_INBOUNDr+   r,   r-   r   s       r   packet_rpc_netlogon_40r5    sS    ''))A##*)	*(	)* * *
 4r   c                 j    fd}                     |j        j        j                  _        dS )Nc           
         	                                 }	                                \  }}|                                 }|                     t                     t          	j        	j        |           }t          j	        }t          j
        }d}|                    	j        	j                                        ||||||           |                     |           d S r   )r   r   r>   r   r   r   r3   r   r   r   r   netr_LogonSamLogonWithFlagsrX   r   r  )
r0   r   r   r   r  r  r  r  r  r-   s
            r   r  z'packet_rpc_netlogon_45.<locals>.connect  s    ++--0022t ,,..	  !2333#GN$+$8$)+ + C#>
	%%gn&-&;&K&K&M&M&*&*&1&+&6&0	2 	2 	2 	  +++++r   Tr  r  s     ` r   packet_rpc_netlogon_45r9    sV    , , , , ,4 	++G,3,>,3,B,3,E	G 	G 
 4r   c                 V    |                                 }|                                 dS rC   get_samr_context
get_handler4  s       r   packet_samr_0r>    %      ""ALLNNN4r   c                    |                                 }|                                }|j        "|                    |j                   d |_        n|j        "|                    |j                   d |_        n_|j        )|                    |j                   d |_        d |_        n/|j        (|                    |j                   d |_        d |_        dS rC   )	r<  get_connectionuser_handleClosegroup_handledomain_handleridsrg   r   r+   r,   r-   r   ss        r   packet_samr_1rI    s      ""A	A 	} 		
	#		
	$	   	
		4r   c                     |                                 }|                                }|j        t          | ||           |                    |j        d           dS NrV   T)r<  rA  rB  packet_samr_34QuerySecurityrG  s        r   packet_samr_3rN    sY      ""A	A}v|W555OOAM1%%%4r   c                     |                                 }|                                }|                                }t          j                    }|j        |_        |                    ||          |_        dS rC   )	r<  rA  r=  r   r   r3   r*  LookupDomainr   )r+   r,   r-   r   rH  hds          r   packet_samr_5rS    s_      ""A	A	A
A~AH>>!Q''AL4r   c                     |                                 }|                                }|                                }|                    |dd           dS Nr   T)r<  rA  r=  EnumDomainsr+   r,   r-   r   rH  rQ  s         r   packet_samr_6rX    sL      ""A	A	AMM!Q4r   c                    |                                 }|                                }|                                }|j        t	          | ||           |                    |t          j        |j                  |_        dS rC   )	r<  rA  r=  r   rS  
OpenDomainr   r   rE  rW  s         r   packet_samr_7r[    st      ""A	A	A|flG444ll1#+#D#$<1 1AO 4r         c                     |                                 }|                                }|j        t          | ||           t	          j        t                    }|                    |j        |           dS rC   )r<  rA  rE  r[  r]   r^   SAMR_QUERY_DOMAIN_INFO_LEVELSQueryDomainInfor+   r,   r-   r   rH  rx   s         r   packet_samr_8rb    sk      ""A	AflG444M788Eaou---4r   c                     |                                 }|                                }|j        t          | ||           |                    |j        dd           dS )Nd   r   T)r<  rA  rE  r[  EnumDomainAliasesrG  s        r   packet_samr_15rf  '  s]      ""A	AflG444a0004r   c                 0   |                                 }|                                }|j        t          | ||           t	          j                    }t	          j                    }|j        |_        |g|_	        |
                    |j        |           dS rC   )r<  rA  rE  r[  r   r   r   r   r   r   GetAliasMembership)r+   r,   r-   r   rH  r   r   s          r   packet_samr_16ri  2  s      ""A	AflG444<>>D:<<ClCGDI$///4r   c                     |                                 }|                                }|j        t          | ||           t	          j        |j                  }|                    |j        |g          |_        dS rC   )	r<  rA  rE  r[  r   r   rt   r   rF  )r+   r,   r-   r   rH  rH   s         r   packet_samr_17rk  A  sn      ""A	AflG444:g&''D]]1?TF33AF4r   c                    |                                 }|                                }|j        t          | ||           g }|j        D ]!}|j        D ]}|                    |           "|                    |j        |           dS rC   )r<  rA  rF  rk  idsappend
LookupRidsrE  )r+   r,   r-   r   rH  rF  ris           r   packet_samr_18rr  M  s      ""A	Av~v|W555DV   	 	AKKNNNN	LL$'''4r   c                     |                                 }|                                }|j        t          | ||           d}|                    |j        t
          j        |          |_        dS )Ni  T)r<  rA  rE  r[  	OpenGroupr   r   rD  )r+   r,   r-   r   rH  rids         r   packet_samr_19rv  [  sl      ""A	AflG444
C[[!)!B!$& &AN 4r   c                     |                                 }|                                }|j        t          | ||           |                    |j                   dS rC   )r<  rA  rD  rv  QueryGroupMemberrG  s        r   packet_samr_25ry  i  sY      ""A	A~v|W555q~&&&4r   c                    |                                 }|                                }|j        t          | ||           |                    |j        t          j        |j        d         j        d                   |_	        dS rU  )
r<  rA  rF  rk  OpenUserrE  r   r   rm  rB  rG  s        r   rL  rL  s  ss      ""A	Av~v|W555JJq'@ vay}Q/1 1AM 4r   c                     |                                 }|                                }|j        t          | ||           d}|                    |j        |           dS rK  )r<  rA  rB  rL  QueryUserInfora  s         r   packet_samr_36r~    s^      ""A	A}v|W555EOOAM5)))4r   c                     |                                 }|                                }|j        t          | ||           |                    |j                   dS rC   )r<  rA  rB  rL  GetGroupsForUserrG  s        r   packet_samr_39r    sY      ""A	A}v|W555q}%%%4r   c                 V    |                                 }|                                 dS rC   r;  r4  s       r   packet_samr_57r    r?  r   c                 V    |                                 }|                                 dS rC   r;  r4  s       r   packet_samr_64r    r?  r   c                 x    |                                 }d|j        z   }d}d}|                    |||           dS )N\\zIPC$rV   T)get_srvsvc_connectionrX   NetShareGetInfo)r+   r,   r-   rH  
server_unc
share_namerx   s          r   packet_srvsvc_16r    sF    %%''A'.(JJEj*e4444r   c                 r    |                                 }d|j        z   }d}|                    ||           dS )a*  NetSrvGetInfo

    FIXME: Level changed from 102 to 101 here, to bypass Windows error.

    Level 102 will cause WERR_ACCESS_DENIED error against Windows, because:

        > If the level is 102 or 502, the Windows implementation checks whether
        > the caller is a member of one of the groups previously mentioned or
        > is a member of the Power Users local group.

    It passed against Samba since this check is not implemented by Samba yet.

    refer to:

        https://msdn.microsoft.com/en-us/library/cc247297.aspx#Appendix_A_80

    r  e   T)r  rX   NetSrvGetInfo)r+   r,   r-   srvsvcr  rx   s         r   packet_srvsvc_21r    sA    $ **,,F'.(JE
U+++4r   )r   r   r]   	samba.netr   samba.dcerpcr   r   r   r   r   r	   samba.dcerpc.netlogonr
   samba.dcerpc.securityr   samba.netbiosr   	samba.ndrr   samba.credentialsr   r   r   sambar   samba.ntstatusr   r   dns.resolverrE   ldbr   r   r"    DRSUAPI_DS_NAME_FORMAT_FQDN_1779"DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNTDRSUAPI_DS_NAME_FORMAT_DISPLAYDRSUAPI_DS_NAME_FORMAT_GUID DRSUAPI_DS_NAME_FORMAT_CANONICAL%DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL#DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX(DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL)DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY!DRSUAPI_DS_NAME_FORMAT_DNS_DOMAIN'DRSUAPI_DS_NAME_FORMAT_UPN_AND_ALTSECID6DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN_EX2DRSUAPI_DS_NAME_FORMAT_LIST_GLOBAL_CATALOG_SERVERS$DRSUAPI_DS_NAME_FORMAT_UPN_FOR_LOGON4DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_WITH_DCS_IN_SITE&DRSUAPI_DS_NAME_FORMAT_STRING_SID_NAME3DRSUAPI_DS_NAME_FORMAT_ALT_SECURITY_IDENTITIES_NAMEDRSUAPI_DS_NAME_FORMAT_LIST_NCS#DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS&DRSUAPI_DS_NAME_FORMAT_MAP_SCHEMA_GUID3DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT_NAME_SANS_DOMAIN!DRSUAPI_DS_NAME_FORMAT_LIST_ROLES+DRSUAPI_DS_NAME_FORMAT_LIST_INFO_FOR_SERVER6DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_FOR_DOMAIN_IN_SITE+DRSUAPI_DS_NAME_FORMAT_LIST_DOMAINS_IN_SITE+DRSUAPI_DS_NAME_FORMAT_LIST_SERVERS_IN_SITE!DRSUAPI_DS_NAME_FORMAT_LIST_SITESr_   r&   r.   r;   packet_cldap_5packet_dcerpc_0packet_dcerpc_2packet_dcerpc_3packet_dcerpc_11packet_dcerpc_12packet_dcerpc_13packet_dcerpc_14r?   rA   rJ   packet_dns_1rM   dirNAME_FORMATSrk   rz   r   packet_drsuapi_2packet_drsuapi_3packet_drsuapi_4packet_epm_3r   packet_ldap_r   packet_ldap_1r   r   packet_ldap_4packet_ldap_5packet_ldap_6packet_ldap_7packet_ldap_8packet_ldap_9packet_ldap_16packet_lsarpc_0packet_lsarpc_1packet_lsarpc_2packet_lsarpc_3packet_lsarpc_4packet_lsarpc_5packet_lsarpc_6r   r   r   packet_lsarpc_40packet_lsarpc_43packet_lsarpc_44packet_lsarpc_68r   r   r   packet_nbns_1packet_rpc_netlogon_0packet_rpc_netlogon_1packet_rpc_netlogon_4packet_rpc_netlogon_14packet_rpc_netlogon_15packet_rpc_netlogon_21packet_rpc_netlogon_26r   r   packet_rpc_netlogon_34r  r  r   r5  r9  r>  rI  rN  rS  rX  r[  r_  rb  packet_samr_14rf  ri  rk  rr  rv  ry  rL  r~  packet_samr_37r  packet_samr_40packet_samr_44r  r  packet_samr_68r  r  r)   r   r   <module>r     sT  $ 
			         G G G G G G G G G G G G G G G G = = = = = = ) ) ) ) ) )                     
                         $ $ $   ,.*',1/45-3B>0@2?+/2?-7B77-7>@ @ @T           
  
  
       
  ( (ss7|| ( ( (  *          
 
	 	 	 
   
    . 
          "  .  2  
        &     
 $ # # 
 % $ $  % 
    4 %   @! ! !$  6       F    .         "#B    
    	 	 	      	 	 	                 r   