Help needed - execute FSCTL_DFS_GET_REFERRALS

Hello,

I've trying to iterate over a dfs folder without success. My approach so far is:

check if the folder is in dfs by comparing the response with the flag SMB_SHARE_IS_IN_DFS
get the "real" path of the share by executing FSCTL_DFS_GET_REFERRALS request via ioctl
use the path retrieved from the response

Assuming that I have the following structure:

namespace name: ns ---> share folder name: test

I was trying the following approach (the code is written in python because I use impacket as a wrapper):

First I created structure for the request, as described in: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dfsc/663c9b38-41b8-4faa-b6f6-a4576b4cea62

class FSCTL_GET_DFS_REFERRALS_STRUCTURE(Structure):
   structure = (
        ('MaxReferralLevel','<H=0'),
        ('RequestFileName','z')
    )

Then I used this structure to execute the ioctl command:

smbClient = SMBConnection(remoteName='10.16.0.130', remoteHost='10.16.0.130',  sess_port=445)
smbClient.login("share1", "P@SSWORD", "", '', '')
tid = smbClient._SMBConnection.connectTree("ns")

blob = FSCTL_GET_DFS_REFERRALS_STRUCTURE()
blob['MaxReferralLevel'] = 3
blob['RequestFileName'] = "\\test\\".encode('utf-16le')
smbClient._SMBConnection.ioctl(tid, fileId=None, ctlCode=FSCTL_DFS_GET_REFERRALS, flags=SMB2_0_IOCTL_IS_FSCTL, inputBlob=blob, maxInputResponse = 0, maxOutputResponse=0)

But it fails with SMB SessionError: STATUS_INVALID_PARAMETER(An invalid parameter was passed to a service or function.)

If I change the path to: "\\test\\folder\\123.txt\\", it fails with: SMB SessionError: STATUS_NOT_FOUND(The object was not found.)

Can you please guide me towards the solution?

sahlberg / libsmb2

Help needed - execute FSCTL_DFS_GET_REFERRALS #167