drsr_secrets_dump ERROR_DS_UNAVAILABLE_CRIT_EXTENSION

[krasnovu]

Hi @oiweiwei, it's been a long time! 🤝
I've been trying to run the drsr_secrets_dump example from main, but I'm getting an error:

~$ SERVER=10.10.5.132 [email protected] PASSWORD=Password ./drsr_secrets_dump -names test1 -debug
trying to get secret for user test1 with guid {ef34c5aa-093a-46c1-97f2-bf5480f46ec8}
/drsuapi/v4/IDL_DRSGetNCChanges: win32: ERROR_DS_UNAVAILABLE_CRIT_EXTENSION (0x0000202c): The server does not support the requested critical extension.

At the same time, there are several errors in the directory service log on my Windows computer:


I tried to find information about the recycle bin function in MS-DRSR, but I don't understand how to include its support in the sample code if I correctly understood the cause of the error. Perhaps the error has another reason? Do you know anything about this?

[oiweiwei]

Hello, @krasnovu! From what I've observed so far, when trying to run this command against DS as ordinary user is that it mean ordinary lack of certain permissions. It might be the set of attributes requested (which can be filtered by Attributes mask in request - prefix table). Also maybe it has something to do with these extensions https://github.com/oiweiwei/go-msrpc/blob/main/examples/samples_with_config/drsr_secrets_dump.go#L80

Need to check on this, if you have admin access you can try it out and compare if it works.

There are also some permissions might be required: https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/grant-replicating-directory-changes-permission-adma-service

[oiweiwei]

@krasnovu what are the permissions of the user?

[oiweiwei]

I think I've got it. "remote DSA" that is being talked about in the error message is you (that is, script calling GetNCChanges). I've tried to experiment with it and found there is indeed FlagExt for recycle bin:

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/3ee529b1-23db-4996-948a-042f04998e91

RB (DRS_EXT_RECYCLE_BIN, 0x00000004): If present, signifies that the DC has enabled the [Recycle Bin](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/e5c2026b-f732-4c9d-9d60-b945c0ab54eb#gt_54624800-58f4-45e9-90bf-c9b52dcf98f3) [optional feature](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/e5c2026b-f732-4c9d-9d60-b945c0ab54eb#gt_785b66f1-22b3-450f-97aa-a24a39d04d47).

So perhaps we need to signify we support some extensions, so I made the Bind query look like following:

diff --git a/examples/samples_with_config/drsr_secrets_dump.go b/examples/samples_with_config/drsr_secrets_dump.go
index 2c2335b..fbab33b 100644
--- a/examples/samples_with_config/drsr_secrets_dump.go
+++ b/examples/samples_with_config/drsr_secrets_dump.go
@@ -77,7 +77,9 @@ func main() {
        }
 
        clientCaps := drsuapi.ExtensionsInt{
-               Flags: drsuapi.ExtGetNCChangesRequestV8 | drsuapi.ExtStrongEncryption | drsuapi.ExtGetNCChangesReplyV6,
+               Flags:    drsuapi.ExtGetNCChangesRequestV8 | drsuapi.ExtStrongEncryption | drsuapi.ExtGetNCChangesReplyV6,
+               FlagsExt: 0xFFFFFFFF,
+               ExtCaps:  0xFFFFFFFF,
        }
 
        b, err := ndr.Marshal(&clientCaps, ndr.Opaque)
@@ -94,6 +96,15 @@ func main() {
                return
        }
 
+       var serverCaps drsuapi.ExtensionsInt
+
+       if err := ndr.Unmarshal(resp.Server.Data, &serverCaps, ndr.Opaque); err != nil {
+               fmt.Fprintln(os.Stderr, "unmarshal_server_caps", err)
+               return
+       }
+
+       fmt.Println(J(serverCaps))
+
        // get the id using the provided name.
        cracked, err := cli.CrackNames(ctx, &drsuapi.CrackNamesRequest{
                Handle:    resp.DRS,

and it stopped to complain about features and started to complain about BAD_DN (which is expected).

[oiweiwei]

you can try with latest main and let me know.

[krasnovu]

The code is working now, this piece of ExtCaps: 0xFFFFFFFF helped! I am amazed at how easily you understand this communication with MS, an expert in this field! Thank you, you helped me once again! 🤝 I hope my questions will help you make the library even better!