Module drsuapi 

👎Deprecated since 0.2.1:

moved to standalone crate ms-drsr; will be removed in dcerpc 0.4.0

DRSUAPI (MS-DRSR) — the directory replication interface used for DCSync.

DEPRECATED: this module is kept as-is for backward compatibility. New code should depend on the standalone ms-drsr crate — it ships the same protocol with faster iteration and no dcerpc coupling. This module will be removed in dcerpc 0.4.0.

DCSync abuses replication: bind to DRSUAPI over a sign+sealed ncacn_ip_tcp channel (DRSBind), then request a single object’s secrets with DRSGetNCChanges (EXOP_REPL_OBJ). The reply carries the account’s attributes with the secrets encrypted under the NTLM session key; a per-RID DES pass then recovers the NT hash.

This module marshals the DRS structures by hand on top of crate::ndr. DRSBind is implemented and validated live; DRSGetNCChanges builds on the same primitives.

Modules

opnumDeprecated

Structs

DrsSessionDeprecated

An established DRS session: the sealed RPC connection plus the server-returned handle.

KerbKeyDeprecated

One Kerberos key from supplementalCredentials.

Functions

drsuapi_syntaxDeprecated

DRSUAPI interface: e3514235-4b06-11d1-ab04-00c04fc2dcd2 v4.0.

parse_kerberos_keysDeprecated

Parse a decrypted supplementalCredentials (USER_PROPERTIES, MS-SAMR 2.2.10) for the Primary:Kerberos-Newer-Keys package → the current AES256/AES128 keys.