Module dcom 

DCOM (MS-DCOM) — the foundation for remote activation and WMI execution over ORPC.

Status: foundation layer. This implements the OXID-resolver interface (IObjectExporter, a plain RPC interface reachable anonymously on TCP/135) and the shared ORPC pieces (well-known IIDs/CLSIDs, the ORPCTHIS header every ORPC call carries). The full WMI-exec chain that builds on this — ISystemActivator::RemoteCreateInstance with the activation-properties blob, OXID resolution to the activated object’s dynamic endpoint, IWbemLevel1Login::NTLMLogin, and IWbemServices::ExecMethod for Win32_Process.Create with CIM-object marshaling — is not implemented yet. See the module tests + the roadmap.

Structs

ObjectExporter

The IObjectExporter (OXID resolver) client on TCP/135. This is the reachable, anonymous entry point to a host’s DCOM subsystem and the resolver that later turns an OXID into the dynamic endpoint of an activated object.

Constants

CLSID_WBEM_LEVEL1_LOGIN

CLSID of the WBEM level-1 login object to activate on the target.

COMVERSION_MAJOR

ORPC minor version negotiated by current Windows (COMVERSION 5.7).

COMVERSION_MINOR

IID_IOBJECT_EXPORTER

IObjectExporter (the OXID resolver / ping interface), always on ncacn_ip_tcp:135.

IID_IREMUNKNOWN

IRemUnknown — remote reference counting on an activated object (opnums RemQueryInterface=3…).

IID_ISYSTEM_ACTIVATOR

ISystemActivator — RemoteCreateInstance (opnum 4) activates a class on the target.

IID_IWBEM_LEVEL1_LOGIN

IWbemLevel1Login — NTLMLogin hands back an IWbemServices pointer for a namespace.

IID_IWBEM_SERVICES

IWbemServices — GetObject / ExecMethod (Win32_Process.Create lives here).

Functions

orpc_this

Encode an ORPCTHIS (MS-DCOM 2.2.13.4) — the header every ORPC method stub begins with, ahead of the interface’s own parameters. cid is the causality id (a GUID identifying the logical call chain). Layout: COMVERSION(4) · flags(4) · reserved(4) · CID(16) · extensions pointer(4, null) = 32 bytes.

orpc_this_flags

ORPCTHIS with an explicit flags word: impacket sets 1 on the activation call (RemoteCreateInstance) but 0 on ordinary ORPC method calls (NTLMLogin, ExecMethod, …).